{ "schemaVersion": 1, "generatedAt": "2026-10-22T09:34:44.843Z", "evaluation": "label_informed_model_followup_with_untouched_model_cohort", "baseline": { "rawReceiptPath": "/benchmarks/model-detection-pilot-2026-10-21-a7badfa984c44458.json", "receiptSha256": "a7badfa984c4445849d467416d1386472e6b0b7cb4f9cb7c208b014020d3954a" }, "comparison": { "cases": [ { "id": "BenchmarkTest00094", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 54 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00620", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 50 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest00588", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 55 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } } } }, { "id": "BenchmarkTest00641", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 59 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 3 }, "after": { "status": "complete", "detected": true, "findingCount": 3 } } } }, { "id": "BenchmarkTest00780", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 51 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest01047", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 51 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } } } }, { "id": "BenchmarkTest00152", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 46 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00497", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 43 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 3 } } } }, { "id": "BenchmarkTest00660", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 54 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00898", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 49 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest01209", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 52 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00068", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 49 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest00292", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 54 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } } } }, { "id": "BenchmarkTest00541", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 48, 50 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest00415", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 62, 63, 64, 65 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00494", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 57, 58, 59, 60 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 3 }, "after": { "status": "complete", "detected": true, "findingCount": 3 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 3 }, "after": { "status": "complete", "detected": true, "findingCount": 3 } } } }, { "id": "BenchmarkTest00943", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 55 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00844", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 50 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest00512", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 56 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00511", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 57 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest00452", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 43, 44, 45, 47 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00841", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 49, 50, 51, 53 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } } } }, { "id": "BenchmarkTest00012", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 51 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest00099", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 49 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": true, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } }, { "id": "BenchmarkTest00991", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 60 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } } } }, { "id": "BenchmarkTest01200", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 45 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 3 }, "after": { "status": "complete", "detected": true, "findingCount": 3 } } } }, { "id": "BenchmarkTest00818", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 49 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 0 }, "after": { "status": "complete", "detected": false, "findingCount": 0 } }, "servedCombined": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": false, "findingCount": 1 } } } }, { "id": "BenchmarkTest00161", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 40 ], "outcomes": { "nativeDeterministic": { "before": { "status": "complete", "detected": true, "findingCount": 2 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } }, "modelOnlyMapped": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "modelOnlyVerified": { "before": { "status": "complete", "detected": false, "findingCount": 1 }, "after": { "status": "complete", "detected": true, "findingCount": 1 } }, "servedCombined": { "before": { "status": "complete", "detected": true, "findingCount": 3 }, "after": { "status": "complete", "detected": true, "findingCount": 2 } } } } ], "before": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 6, "fn": 8, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 5, "fn": 9, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 } }, "after": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 7, "fn": 7, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 7, "fn": 7, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 } } }, "diagnosticRows": [ { "id": "BenchmarkTest00094", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 54 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 44, "endLine": 46 } ], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00620", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 50 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 48, "endLine": 50 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 49, "endLine": 50 } ], "modelOnlyVerified": [ { "cwe": "CWE-22", "startLine": 49, "endLine": 50 } ], "servedCombined": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ] } }, { "id": "BenchmarkTest00588", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 55 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ] } }, { "id": "BenchmarkTest00641", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 59 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyMapped": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 60 } ], "modelOnlyVerified": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 60 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 }, { "cwe": "CWE-327", "startLine": 59, "endLine": 60 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyMapped": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ], "modelOnlyVerified": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 }, { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ] } }, { "id": "BenchmarkTest00780", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 51 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest01047", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 51 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyVerified": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "servedCombined": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ] } }, { "id": "BenchmarkTest00152", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 46 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00497", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 43 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ], "modelOnlyVerified": [ { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ], "servedCombined": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ] } }, { "id": "BenchmarkTest00660", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 54 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 58 } ], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00898", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 49 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-502", "startLine": 48, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-502", "startLine": 48, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ] } }, { "id": "BenchmarkTest01209", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 52 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 52, "endLine": 52 } ], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00068", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 49 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 47, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 47, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ] } }, { "id": "BenchmarkTest00292", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 54 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ] } }, { "id": "BenchmarkTest00541", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 48, 50 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "modelOnlyVerified": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "modelOnlyVerified": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ] } }, { "id": "BenchmarkTest00415", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 62, 63, 64, 65 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00494", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 57, 58, 59, 60 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ], "modelOnlyMapped": [ { "cwe": "CWE-614", "startLine": 57, "endLine": 60 } ], "modelOnlyVerified": [ { "cwe": "CWE-614", "startLine": 57, "endLine": 60 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ] } }, { "id": "BenchmarkTest00943", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 55 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-643", "startLine": 54, "endLine": 55 } ], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": null, "startLine": 55, "endLine": 55 } ], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00844", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 50 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] } }, { "id": "BenchmarkTest00512", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 56 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 53, "endLine": 56 } ], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 56, "endLine": 56 } ], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00511", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 57 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ] } }, { "id": "BenchmarkTest00452", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 43, 44, 45, 47 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00841", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 49, 50, 51, 53 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 49, "endLine": 51 } ], "modelOnlyVerified": [ { "cwe": "CWE-79", "startLine": 49, "endLine": 51 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] } }, { "id": "BenchmarkTest00012", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 51 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest00099", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 49 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ] } }, { "id": "BenchmarkTest00991", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 60 ], "before": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ] }, "after": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "modelOnlyVerified": [], "servedCombined": [] } }, { "id": "BenchmarkTest01200", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 45 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 }, { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 }, { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ] } }, { "id": "BenchmarkTest00818", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 49 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 47, "endLine": 50 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ] } }, { "id": "BenchmarkTest00161", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 40 ], "before": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 39, "endLine": 40 } ], "modelOnlyVerified": [ { "cwe": "CWE-95", "startLine": 39, "endLine": 40 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-95", "startLine": 39, "endLine": 40 } ] }, "after": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 } ], "modelOnlyVerified": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ] } } ], "runs": { "reconstructed": { "schemaVersion": 1, "protocolSha256": "e27011856db86c864347d559492a9db90f1de2ab903d718acdfec2e70cbb6395", "frozenAt": "2026-10-22T02:40:22.446Z", "startedAt": "2026-10-22T02:40:22.552Z", "finishedAt": "2026-10-22T02:41:44.414Z", "suite": { "name": "OWASP BenchmarkPython v0.1 balanced 28-case model detection-stage pilot", "repository": "https://github.com/OWASP-Benchmark/BenchmarkPython", "revision": "f1291485808b66e20ddb6b01b10dc71b3df8c8ba", "labelsSha256": "6396f37c97cfd0c018db3d8750095ce6c678a083f83620cfb3e88fe27a46bb0c", "totalCases": 1230 }, "config": { "model": "deepseek-v4-flash", "baseUrl": "https://api.deepseek.com", "concurrency": 1, "timeoutMs": 240000, "reasoningEffort": "none", "chainReasoningEffort": "low" }, "runtime": { "bun": "1.3.11", "node": "v24.3.0", "platform": "darwin", "arch": "arm64" }, "sourceIdentities": [ { "path": "apps/scan-cli/package.json", "sha256": "cc9d0ae3f24a0f1a2858e9ff0663c4804b88c77f8e2b8cf8a8b1082dc0e3d024" }, { "path": "apps/scan-cli/src/analysis-cache.ts", "sha256": "d0baba6157b77cf5cba8f8f6ac59d7929442ca9f144081b3622af80fac1f147f" }, { "path": "apps/scan-cli/src/analysisCoverage.ts", "sha256": "e3e0ba94e08f15d16db22214b3169798241d27ace83e9c2b3339ac2fde0f8ae4" }, { "path": "apps/scan-cli/src/appmodel.ts", "sha256": "11cb10ad4dc07e45360addf350638c231942a34c8a94cb56dffd687d40658f9c" }, { "path": "apps/scan-cli/src/batching.ts", "sha256": "70bb6ae15948ac1bd35c6534b885783cc14eb5bdc91fa4d99cb055bbe1e9b7b3" }, { "path": "apps/scan-cli/src/bench.ts", "sha256": "ab27ed544a3cab9d34bad1525bf3667c6604a7bd8ff32f2ab1c81211f2686162" }, { "path": "apps/scan-cli/src/benchmark-scorecard.ts", "sha256": "025b9f1a2fa845985d9fafbb6e84e6a39557eb73eba6064fcc2486b9a45979ee" }, { "path": "apps/scan-cli/src/cassette.ts", "sha256": "a811a8a9037156049094648cddb02ea0fd28938e4d5d7f9ba7a5d520d8ddb1c2" }, { "path": "apps/scan-cli/src/context.ts", "sha256": "26e02925eb5f20405171950bb35d20aaf71aa67eade8482ea70e4c89ced0ac1e" }, { "path": "apps/scan-cli/src/coverage.ts", "sha256": "10c0366ba24dfeb8792f4e1b817293186c6f1b6471cc4d01b2dc4096abc9e910" }, { "path": "apps/scan-cli/src/coverageReport.ts", "sha256": "e8eed15e9df0baefcd94ace34fcf0e63119e87ac4bea3595c2a279a060687a19" }, { "path": "apps/scan-cli/src/deepdive.ts", "sha256": "49c5913019358f87477bc93cab3daaa391beb8ebc307b55637d8f1c9234d8de9" }, { "path": "apps/scan-cli/src/deepseek.ts", "sha256": "b922cbf013b81ed1c3d682ce6e67868a3526034efd011ca6eb78dfc7e1ad8543" }, { "path": "apps/scan-cli/src/defences.ts", "sha256": "fb11f03b658d149a5e74bd8a18c74f27dc74aa24152d301703a1126c5723478f" }, { "path": "apps/scan-cli/src/depGraph.ts", "sha256": "b2e354315743883ed58cdcb22b3e242267e27ad3745ae11903f5d93c278be1f0" }, { "path": "apps/scan-cli/src/dependency-observations.ts", "sha256": "d8c14d1d944f1870602d35ec2d2e5b297e161423a0ed242256c60927b922f02a" }, { "path": "apps/scan-cli/src/depth.ts", "sha256": "3d3a5bbcfae2360b1b8045c5bf997523ce289835d17cef5752732bb895fb6405" }, { "path": "apps/scan-cli/src/envNames.ts", "sha256": "97071edd26823ab361d481785c04066eedabe6a5866c425562f089b4c7cc2c69" }, { "path": "apps/scan-cli/src/finding-response.ts", "sha256": "645faff3e3e6f9bd1d7bb7a7f93dab6bdb3f28787f08a6b97670193b5af1dc4a" }, { "path": "apps/scan-cli/src/fingerprint.ts", "sha256": "058ef82e52a20e2207d5c356bf8780a4bb8c02e88873be4bc079539c77225306" }, { "path": "apps/scan-cli/src/gates.ts", "sha256": "cc1f057e50be79d3fd397994dfc1df202812f05cf117b0145716c9c86d02e377" }, { "path": "apps/scan-cli/src/gitleaks.ts", "sha256": "3b45e13abb74de4f204acb29c82b3c8a3c6628373fe91c590bd4ea377f9bec38" }, { "path": "apps/scan-cli/src/helpers.ts", "sha256": "ae9c19d7ff10118b3089d4709a04f0cc749083dfe23d3e0c865b692ac32cc4b6" }, { "path": "apps/scan-cli/src/iac.ts", "sha256": "78011b64b0c4da54861405f19b9e33fe9f5b42f5c2108330c9fe46f17fd033ed" }, { "path": "apps/scan-cli/src/image.ts", "sha256": "a7aa4b3605587ec02c07116058a720c7b894b34b000598010f67061bbc9e2e22" }, { "path": "apps/scan-cli/src/imports.ts", "sha256": "37e654e1643d66d1b4b3dd08a71f029c85221f24bc1857a52f4c289e536de42a" }, { "path": "apps/scan-cli/src/independent-benchmark.ts", "sha256": "44d2a86c3e10ea7b897800dec90f7e73fd7096bc575c4fbdac50308a4561f242" }, { "path": "apps/scan-cli/src/index.ts", "sha256": "28244b9a65713e5d5f4e5a5581de5302372e1a5436870f1543dc5936805fd632" }, { "path": "apps/scan-cli/src/intelligence.ts", "sha256": "93bfb294b41bdf1616533ac6445c271430497e0def81e6443ef723c6a35efc90" }, { "path": "apps/scan-cli/src/kernel.ts", "sha256": "18f2d1eeeeacc4b528e343c91cae0b08bc6e252427e886af5470730d8774d4f0" }, { "path": "apps/scan-cli/src/logger.ts", "sha256": "3d53733daa48af057f2709b29af2d0e506af3f62764ea64cd1b5758be0ba8582" }, { "path": "apps/scan-cli/src/manifests.ts", "sha256": "bb1672c1bd3c1d399c16878572874efbe5e648e33b88e61455ba98b574d04af7" }, { "path": "apps/scan-cli/src/mapFinding.ts", "sha256": "be3ec1f53d70c7f6021ad695ffc37363e46d2dd34b047c14ade59dce2401459a" }, { "path": "apps/scan-cli/src/model-benchmark.ts", "sha256": "e633c855a82bf50e395bfcc099abbece14878203eecd6ddd152d2b9c8a4996e2" }, { "path": "apps/scan-cli/src/noise.ts", "sha256": "5d30d0453a93bd04a4bc10be6692d8a9813677dee35c7c3ba7af12ee7fb16bfa" }, { "path": "apps/scan-cli/src/oci.ts", "sha256": "c5600f5dbeb7e786ebcf0a75cf1d24c35314af3fcdcdc681feac7ad1154f7277" }, { "path": "apps/scan-cli/src/openapi.ts", "sha256": "6223b8611795454a8f0f52ec1f7bb577f19b144d41cb19dd226dc6c7168328c9" }, { "path": "apps/scan-cli/src/osdb.ts", "sha256": "cd464bb11b5953068934c17cde3f10bedaeaaed03fdf6d85cf267a2df0145e6b" }, { "path": "apps/scan-cli/src/prefilter.ts", "sha256": "53571e87886dbc160b0d64cac8a485c84d539c34e2a67bc07262350c2b83176f" }, { "path": "apps/scan-cli/src/prompts.ts", "sha256": "779e2bf648450965965cb690bca7cdf64dd584dfc1e2a6b29e56bd1b95e4eb01" }, { "path": "apps/scan-cli/src/pullRequest.ts", "sha256": "2fbfa5525a0a9e9e0f9f35348429f397cc37bf22a897f779ea83e31a3d7c31bd" }, { "path": "apps/scan-cli/src/python-config.ts", "sha256": "cbd69945e59780938e88bbd3ba594696ad7c4fcfe00550e4a07102bd685e4065" }, { "path": "apps/scan-cli/src/python-flow.ts", "sha256": "ffc6d7325bbfefcc33b295998ee00ca3fb6fcf3af5df6391afff60a59ac34ade" }, { "path": "apps/scan-cli/src/quality.ts", "sha256": "7b69ff447ff7d673420eb84fc13c19b8b3a779f18bc01feb3c5c44166bcce40e" }, { "path": "apps/scan-cli/src/reachGraph.ts", "sha256": "099e451f8b1cf41d631d2831dba4629e4bc7ea0c31ce6b1291571e4f602dbd04" }, { "path": "apps/scan-cli/src/reachability.ts", "sha256": "fa01a82a0bca1a3ba67faca4f6fdc209fc0b81f099b59f70ead33dc6a1d5c24a" }, { "path": "apps/scan-cli/src/recovery.ts", "sha256": "c51f097dc8f7dfa1f0576c9c66fc459acb615122ad9e9d78b7ecad124b6c7e98" }, { "path": "apps/scan-cli/src/relatedSpans.ts", "sha256": "b455844c8a2dd2c8a91e56a291920ed34c7a3fb003c6cb285a82f2c5a92aaf2e" }, { "path": "apps/scan-cli/src/repoSecrets.ts", "sha256": "071dd5a1b259aa2cbf7adcd32b5a6010c69a8601711ae5a3f74117df35611d0f" }, { "path": "apps/scan-cli/src/reporter.ts", "sha256": "7c1ee9071898d0c47eb79c6542c7bd677933eda9f159f0dea9fcdcafc28bcbd6" }, { "path": "apps/scan-cli/src/repository-benchmark.ts", "sha256": "dc324cf0bf446082626a6bd31879782a6516149bd45d9293d7dbc519d7f08cb4" }, { "path": "apps/scan-cli/src/rule-defenses.ts", "sha256": "02e15e50eeefe594378f0cf7e9925d651df06561e64fe06365c7bcfdb3dcf1a1" }, { "path": "apps/scan-cli/src/rules.ts", "sha256": "4cd142f29398311478e0931f6f2cc0646d03d8f7448c423751927773996e4889" }, { "path": "apps/scan-cli/src/sbom.ts", "sha256": "2f76a139d11e49b67a826603881cbf81ffc4474bc4bd9fde6506e0c558c8f0d9" }, { "path": "apps/scan-cli/src/scan.ts", "sha256": "bee311f28f7ae08f0076cdc4289671dc7895e607024cb525b6af8febf69635da" }, { "path": "apps/scan-cli/src/scanVersions.ts", "sha256": "5e3991039c32835b23767c90aafaa33ab15a6e61f7e01a9b0d3ab5683c602653" }, { "path": "apps/scan-cli/src/search.ts", "sha256": "f9db1c3b5fe9900a6e4f4335d53ada9083e2ae932ebcee853b56f527ba95f219" }, { "path": "apps/scan-cli/src/silence.ts", "sha256": "8c65ac7f0df90c9c15394ac6de861f86ce3d89a2930a8ebe7445d63eaa5e2787" }, { "path": "apps/scan-cli/src/spread.ts", "sha256": "2d80502b0d1b0d453aa0e2da7513fefdf75755a37d5af1e3cf6a5cb08b12d9d0" }, { "path": "apps/scan-cli/src/stability.ts", "sha256": "61012aae5957361f46a8f15413ea429e7350fefabce4e9e0e6fa972278cc34e7" }, { "path": "apps/scan-cli/src/stop.ts", "sha256": "d35e4491a63e6792342b8b5deea342a2b4bbe22975aeb6f26c51537e2275fd6f" }, { "path": "apps/scan-cli/src/sweep.ts", "sha256": "356678c7373530b517e05ab46e58d09df0eb7484a8bcca6f2b7b50a5753abc2b" }, { "path": "apps/scan-cli/src/tar.ts", "sha256": "2c80b52c78e9c75185ed90b3cd4f4a6bca969fe0d1c736f15f8b72e47773e6f6" }, { "path": "apps/scan-cli/src/template-flow.ts", "sha256": "435188aca557af792af85cb0553cac1361e075e2d3e007f8963b2e399810469b" }, { "path": "apps/scan-cli/src/tools.ts", "sha256": "cf9de13aa44e1550fdeedfba7e25ac7ccf36b289825a8eaf3f1928cf8b5df3d8" }, { "path": "apps/scan-cli/src/trivy.ts", "sha256": "150153c1b23996bc0f8a32301c65d0bff0be1fa2fae6cb7eb0f5c581c700c236" }, { "path": "apps/scan-cli/src/verdict-contract.ts", "sha256": "e24ab43d9f4cc96ebd2e3948286779b2e0b0390f42106f14b3b7eef3bcee9d61" }, { "path": "apps/scan-cli/src/verify.ts", "sha256": "71d0315264ad5afc61d8c0fef34b366db38477eac30767b9ac0137fc61129e7b" }, { "path": "apps/scan-cli/src/walk.ts", "sha256": "3d2a350dfe6e25403e50eefa3a0dbaebe275b422950717fc438be3bd5c74d097" }, { "path": "bun.lock", "sha256": "14b55bb0ae964bab83edb70d146e5e5eac16a7ef7418b4bd94842a5335edbbbd" }, { "path": "package.json", "sha256": "0c61121892bbd320487234c977f0e12f550a611adcb621d86d138c60cf0f6422" }, { "path": "packages/schemas/package.json", "sha256": "a46ecb31aa9aa33ceb6daafae8394ccdfa228fc7789198c421a02c0999aaa786" }, { "path": "packages/schemas/src/billing.ts", "sha256": "7ae419533da6bc2a20ad243b33b452dcd25d7dd67fe6c4b89c7d44193818322e" }, { "path": "packages/schemas/src/careers.ts", "sha256": "c367f27b05dfdc9d57e25fe9987bf21e78f3f65ea9556afccea999cbfc068c46" }, { "path": "packages/schemas/src/dependencyObservations.ts", "sha256": "d5a641b059b22592c692d3283502b9d77213ec42e77e03e600d0a20ee72d4038" }, { "path": "packages/schemas/src/findings.ts", "sha256": "a12c3448f1e41d2eda5313f9b9a8fcf64ed2b77ebc80e5e22a7c682060878a38" }, { "path": "packages/schemas/src/immunity.ts", "sha256": "cbe2557cc42d164e9d677f92ab8e26ce12762b4b2f60d5a3f2430b59a793abce" }, { "path": "packages/schemas/src/index.ts", "sha256": "dc8572d1089083d76301bdf8634bfe9565973f00e6cc49beca1101df17ec4cbe" }, { "path": "packages/schemas/src/investigation.ts", "sha256": "0a4a6a4370ff428910b2fb0ef53450fae064392dc58e341f8eb33da2252300b5" }, { "path": "packages/schemas/src/ir.ts", "sha256": "c1b1d0766b20e4830a9a6ab35d27ba16dc676f9a4c2a9badebd4fdbd17919df8" }, { "path": "packages/schemas/src/knowledge.ts", "sha256": "74488c0199366e71df6c2a83e71333317392e6b010e88f6beb66b935cec4bc85" }, { "path": "packages/schemas/src/notifications.ts", "sha256": "994d00573e810665c4379c2cb86147d28ac588ffca1b7f5c305cbd3ee98578c9" }, { "path": "packages/schemas/src/packages.ts", "sha256": "cabe240416e6c35be7baae9e776017e272f03efc5c4bcac3db05b3c11fa75d7e" }, { "path": "packages/schemas/src/proof.ts", "sha256": "80dcb156960b75ec0dee7e607fba08229ddc0cccb5c8951e813274b27340953f" }, { "path": "packages/schemas/src/reachability.ts", "sha256": "6f78887ccf9f09df85e9cad8b5c271fd036782846bcdd301de44e85645f86b39" }, { "path": "packages/schemas/src/reproduction.ts", "sha256": "ef08346d379d5f325bd579a7536679fef7d09fab7f4925392c55c55fd3aa7ab5" }, { "path": "packages/schemas/src/scanCompletion.ts", "sha256": "881dd9263b32be386c364e8595562cadf7e9cbda9efe5aa64abac11b798c7e8f" }, { "path": "packages/schemas/src/scanPullRequest.ts", "sha256": "09e56c5771b087884f735f69a3f3cb625f99e7aab1a867fd1f469fd1906ba2b6" }, { "path": "packages/schemas/src/scanReasons.ts", "sha256": "fba539e6d3c2140db2a329a6be9ce53e7ed0f6dc4437f085d2ce014be71d200a" }, { "path": "packages/schemas/src/secretRepair.ts", "sha256": "f139123f488ba9a19e2a22bcd02544986d0e056358876a3db51655f7d5a99be2" }, { "path": "packages/schemas/src/secrets.ts", "sha256": "e3a898bcadcbc68d0587b513db1d1945174437f358e0fe33624e97df50b42c00" }, { "path": "packages/schemas/src/security.ts", "sha256": "311afcee8ce9a869a622a19e2b1db1e57e003ace1f655921760ec21689a46f44" }, { "path": "packages/schemas/src/states.ts", "sha256": "540c39ae578d9f7cae4ab84e5e183852e6eb84ae49d1d992c2cbf8c2e81a66b6" }, { "path": "packages/schemas/src/wire.ts", "sha256": "b0c21292deadef07a17133b79eb89e4d3dc3dd6bfd165f61653efb699d9d6c3d" }, { "path": "packages/schemas/src/workspace.ts", "sha256": "17a5fab2b0f41f698fbe2f1eceb055c035ae04bec35f547c03531d2e0eefbf42" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/rule.yaml", "sha256": "add1d0987ffcb76cf8286d4da2210674893a8a8c693c9afacb5f4adbbfc7f73d" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/safe/sanitized_html.ts", "sha256": "0d602cd9ae708c8060652de16f1c361a5522dc81d81624e8bdaaaae2664457d2" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/vulnerable/bypass_trust_html.ts", "sha256": "dda816ef1b3d98aa23f109516466c901b66bee2cc3c4742f997ddbf75dac2165" }, { "path": "rulepacks/common/CLEARTEXT-001/rule.yaml", "sha256": "19d83cbe5fabd840248811236a6426d860695cc99d57105d7f67d71b46cfb809" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/safe/https_endpoint.ts", "sha256": "c497ad77c81fd53d387c2b5b10161388c87628740d0b678891581d330ab1ca03" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/vulnerable/ftp_endpoint.ts", "sha256": "c3a6c3a828cc4cdca45bbdf486c6c2856066163884baa74f760a91e896f11870" }, { "path": "rulepacks/common/CMDI-001/rule.yaml", "sha256": "76a524d4596595bec3d2b8550e593f8f73b2c463c594bb7a70f2cb8c3ea9346c" }, { "path": "rulepacks/common/CODE-001/rule.yaml", "sha256": "313aa196ab864dd25536b018605c1c3b36f18956a367376ee0e005bb319f58be" }, { "path": "rulepacks/common/CODE-001/tests/safe/comment_mentions_eval.ts", "sha256": "a47f8173953238cb60d08856a1b037366fbe536a88da34b23c643e9cad35d572" }, { "path": "rulepacks/common/CODE-001/tests/safe/literal_mentions_eval.ts", "sha256": "3d09dab28d07ba35d263943091655822f5f5d217b2d6fccbbf3f9cb435bacfc2" }, { "path": "rulepacks/common/CODE-001/tests/vulnerable/eval_query.ts", "sha256": "e3f4f0d3c518040aa2696ea7f76ff19db67601d38be08b42373615b3ded3dae0" }, { "path": "rulepacks/common/DESER-001/rule.yaml", "sha256": "20b2f7b0d2b0a0dbf7d8725589a031e8d7cb58d318d151d099bfc1c2e484dd79" }, { "path": "rulepacks/common/DESER-001/tests/safe/yaml_safe_load.ts", "sha256": "7aaaf0beb687fdadfafbc7d6d1a952647353a222571032ea59242f87bf33dba9" }, { "path": "rulepacks/common/DESER-001/tests/vulnerable/yaml_load_body.ts", "sha256": "f108c65e1710a394fa1785691e1cb6d621e3e0b778da96403788137e3156453a" }, { "path": "rulepacks/common/PATH-001/rule.yaml", "sha256": "b45b1cfe6d8c5af96ec1e8a1c837feeb8ddc239424adca3c188a64c161a00d2f" }, { "path": "rulepacks/common/PATH-001/tests/safe/read_normalized_path.ts", "sha256": "de57b93ba7c7f086a1a9de7d2872628ccb63d84da3fb2fa1ef195bf58b0d2ca6" }, { "path": "rulepacks/common/PATH-001/tests/safe/template_allowlisted.ts", "sha256": "d1d539bba782f1be978bfc1758690d38426278adaf1a44dbf76705e47ce6618b" }, { "path": "rulepacks/common/PATH-001/tests/vulnerable/read_user_path.ts", "sha256": "f1b1f2b69e5992f4004d8a30d0e696fb19d21cd1cb02927e61687e5991d7569d" }, { "path": "rulepacks/common/REDIR-001/rule.yaml", "sha256": "ebaba25880fec0039dad28bd24cbdd36541ab08036ce72527d31363ba37551f7" }, { "path": "rulepacks/common/REDIR-001/tests/safe/redirect_allowlist.ts", "sha256": "903c9879c7b4b35624849633a17e8a34a86dc25f4526cc3df5342b5bb0e49bde" }, { "path": "rulepacks/common/REDIR-001/tests/vulnerable/open_redirect.ts", "sha256": "efd4e225c944fb8647054fa952e40f0d6f3b3b905e22a6bf89f4b2c310daf363" }, { "path": "rulepacks/common/SQLI-001/rule.yaml", "sha256": "3e64945a2e853ae7bbd868a110edbca234966a170a03f3dfe6f49de7077c6fcc" }, { "path": "rulepacks/common/SQLI-001/tests/safe/drizzle_where.ts", "sha256": "106f09d70c246f993c7098b5d059bea9b836d1d025154d2c21b2b330519e7ceb" }, { "path": "rulepacks/common/SQLI-001/tests/safe/identifier_allowlist.ts", "sha256": "bca1e858b9fda6aff77dc1334c96e61446966250ab503c5832c0ef2919ce8436" }, { "path": "rulepacks/common/SQLI-001/tests/safe/parameterized_query.ts", "sha256": "bc711ba097116beaedf72e93c7b3b20b961a2d1258948ecb0dbe6e0ab8831a4c" }, { "path": "rulepacks/common/SQLI-001/tests/vulnerable/concat_query.ts", "sha256": "a2429d8b1f611d41495a356ac305368dc5b78092e491a43bedf6a0f663b6ecb8" }, { "path": "rulepacks/common/SSRF-001/rule.yaml", "sha256": "86bbbbd1f8bfe819cb8af8bde8ca5e43e038979c728fa8ad030641777a631f3e" }, { "path": "rulepacks/common/SSRF-001/tests/safe/express_proxy_allowlist.ts", "sha256": "571f26fc750cdb14b72c7803cd2dd50d62acd806d1677dd5165aa92060ecd21f" }, { "path": "rulepacks/common/SSRF-001/tests/vulnerable/express_proxy.ts", "sha256": "e4f646374bcb08c30fb8af627a91668f4841512cebe1bf804f79c0c4cc2229ab" }, { "path": "rulepacks/common/SSTI-001/rule.yaml", "sha256": "1cf2a5878dad69f9adf9cad88ea2000064898a51447e053a47ef05581954edde" }, { "path": "rulepacks/common/SSTI-001/tests/safe/precompiled_template.ts", "sha256": "0d5febf5ff8f2070115eaeba0870cdfcd392a2dd142487f0a996b04cc491a6e1" }, { "path": "rulepacks/common/SSTI-001/tests/vulnerable/handlebars_compile.ts", "sha256": "4b04998aa32236b06404c7c9aaf2674d01173576b2401efd4904166a4f30fd5f" }, { "path": "rulepacks/common/UPLOAD-001/rule.yaml", "sha256": "e5d8812fab296e63bb94fed6486797995e830fd2feedb5e4ac567bb7e904600b" }, { "path": "rulepacks/common/UPLOAD-001/tests/safe/mime_checked_upload.ts", "sha256": "e020db518e233ac8433f5237c1744d70d6854bd802dbd232f6377d1e03c9aa77" }, { "path": "rulepacks/common/UPLOAD-001/tests/vulnerable/unchecked_upload.ts", "sha256": "c2c4629e3af2db831f72d99572b49c758174bb224e4a2f4abb88ab82f12a3967" }, { "path": "rulepacks/common/XSS-001/rule.yaml", "sha256": "4eafa1e0a5329f76ec075e03d6bf756570cd1643ec4b1aaff9f4ae8960073237" }, { "path": "rulepacks/common/XSS-001/tests/safe/escaped_html.ts", "sha256": "199162c065905fc36a12bae5eedef52093de52b6faea7189b26c94fc4b297fd0" }, { "path": "rulepacks/common/XSS-001/tests/vulnerable/inner_html.ts", "sha256": "9bc3e7f70495dec60e4fae6e44c6525d1f7eed9eaab34f1b7f0c2f62ee334865" }, { "path": "rulepacks/javascript/CMDI-002/rule.yaml", "sha256": "ec140652bbbf75b9ac7abf0491617a7b2fedafec6b01e061afcc455fd46dfab2" }, { "path": "rulepacks/javascript/CODE-002/rule.yaml", "sha256": "5fba2995a7c08491b7fce10659cff11e00d9197bf59a5d3a38f93403ca398b63" }, { "path": "rulepacks/javascript/PATH-002/rule.yaml", "sha256": "6cd1dcc2bd021b507e56eda1048e2d556a7f2d63e174a387c55654dfd32b2fc1" }, { "path": "rulepacks/javascript/PROTO-001/rule.yaml", "sha256": "bf376e71fc05a878df13da0e52dad459fb0c3fd64022d8a69733f3714f6c0ee7" }, { "path": "rulepacks/javascript/PROTO-002/rule.yaml", "sha256": "a33eb6189979feb4815736b9b41878181409cb6582bcbc84cf8b570a8ca6fdde" }, { "path": "rulepacks/javascript/REDOS-001/rule.yaml", "sha256": "b20709f91bfe5bc2b834174a53fb2d0aa2772fd21838191273c117a662d7fbbc" }, { "path": "rulepacks/javascript/REDOS-002/rule.yaml", "sha256": "96c5b0ca1b87ccfd62d47a5cdf0333b9aeb8af676e57db2cb1bf51071a01f128" }, { "path": "rulepacks/javascript/REDOS-003/rule.yaml", "sha256": "1cc53d782185aed8c25f674342c6e25c26bf4fe7d28c11149cd7d4e6c00591b1" }, { "path": "rulepacks/javascript/REDOS-004/rule.yaml", "sha256": "4fc5fa489991681c7b6c7c8fdab2271f0e482c5bdf65cbdb1a5ed14fcc79fefa" }, { "path": "rulepacks/javascript/XSS-002/rule.yaml", "sha256": "265b5dddc5503e3cfede82589a20346e7111aee234aae699bd72010284ab4819" }, { "path": "rulepacks/python/COOKIE-001/rule.yaml", "sha256": "e96b7b90b587fa6d110a094a04a62e892ea7c3e568dc3348cb91152dc31b28eb" }, { "path": "rulepacks/python/DESER-002/rule.yaml", "sha256": "a77cd0730f50c608ddaa4d8446adb7b728522990b1cd772a96648113e522c731" }, { "path": "rulepacks/python/HASH-001/rule.yaml", "sha256": "e73bc710813e3432d33ebd5c3009af465ff431828a6f62023f8134284cb2952c" }, { "path": "rulepacks/python/LDAP-001/rule.yaml", "sha256": "ba5af874b16aced31442688c2696bdce5d653e06777cb8405ba4827fe81299d9" }, { "path": "rulepacks/python/PYEXEC-001/rule.yaml", "sha256": "e894bf53024edc28c99465d76e0ba6cf0041a365c3e47d886f8fa2d4bb9d978f" }, { "path": "rulepacks/python/RANDOM-001/rule.yaml", "sha256": "cc5ef82221e457cd3735ddf1a2460f0ad1b4c0a42d8d046dc6eb8826c8a4401e" }, { "path": "rulepacks/python/SQLI-002/rule.yaml", "sha256": "8870d9e0c8e50ef1e98bdd0a5d340a993fd08bb79c99b83ab0d5d428532efd3c" }, { "path": "rulepacks/python/SSTI-002/rule.yaml", "sha256": "9eaef2a4dd0a2a05427b38d57224363493ae4d6084de444cb972abe363b4a7e5" }, { "path": "rulepacks/python/TRUST-001/rule.yaml", "sha256": "951696eaf7ece7422b37a1fa86d5985f8d3b128d583ce50df98520a877896372" }, { "path": "rulepacks/python/XPATH-001/rule.yaml", "sha256": "17604e33d66d6d7e378932a5979beba8bd09166a0c9bb9fe298cd448ba34d43b" }, { "path": "rulepacks/python/XXE-001/rule.yaml", "sha256": "560eadedab50b15f003f19895559b947ef17958200940ab1099a351b3278bc4d" } ], "selection": { "seed": "cefense-model-stage-pilot-2026-10-21:", "procedure": "Partition all 1230 author-labelled cases by exact expected CWE and vulnerable boolean. Select minimum SHA-256(seed + original case ID) in each of 28 strata. No detector predictions used. Manually inspect selected source before any model inference and declare security operation statement lines. Keep author labels without adjudication.", "selectedCases": 28, "corpusCases": 1230, "unselectedCases": 1202, "caseManifestSha256": "f553622a791a8376dcc78b1dd2e85fe00b89f83b428431b1ccdf546cfb790f1a", "caseIds": [ "BenchmarkTest00094", "BenchmarkTest00620", "BenchmarkTest00588", "BenchmarkTest00641", "BenchmarkTest00780", "BenchmarkTest01047", "BenchmarkTest00152", "BenchmarkTest00497", "BenchmarkTest00660", "BenchmarkTest00898", "BenchmarkTest01209", "BenchmarkTest00068", "BenchmarkTest00292", "BenchmarkTest00541", "BenchmarkTest00415", "BenchmarkTest00494", "BenchmarkTest00943", "BenchmarkTest00844", "BenchmarkTest00512", "BenchmarkTest00511", "BenchmarkTest00452", "BenchmarkTest00841", "BenchmarkTest00012", "BenchmarkTest00099", "BenchmarkTest00991", "BenchmarkTest01200", "BenchmarkTest00818", "BenchmarkTest00161" ], "sinkReview": "Read all 28 selected source post handlers. Anchors identify file reads/writes, digest/token creation, session assignment, parser configuration and parse, cookie security arguments, XPath/SQL/LDAP/command execution, returned HTML construction, or eval/exec. No engine predictions used." }, "plan": { "mode": "default", "maxRounds": 1, "sweepEffort": "none", "verifyEffort": "low", "verifyEnabled": true, "minConfidence": 0.4, "absenceLane": true, "spread": false, "secondOpinion": false, "verifyEngineFindings": false }, "limits": { "requests": 200, "tokens": 2000000, "dollars": 1 }, "scope": "Production detection-stage prompt, snippet mapping gates, configured verification and native union policy. Selected source files only, with imported helper bodies absent. No intelligence retrieval, repository execution, additional sweep/absence/spread/chain lanes, PR generation or full hosted scan. Public label-known corpus, not independent held-out accuracy. Labels and suite identifiers are not model messages. Native findings are never deleted by model review.", "targetPlatform": "unknown", "prices": { "inputUsdPerMillion": 0.3, "outputUsdPerMillion": 1.2, "source": "https://api-docs.deepseek.com/quick_start/pricing/", "checkedAt": "2026-10-22T02:34:26.434840+00:00" }, "planned": 28, "corpusCases": 1230, "unselectedCases": 1202, "scores": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 6, "fn": 8, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 5, "fn": 9, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 } }, "cases": [ { "id": "BenchmarkTest00094", "path": "testcode/BenchmarkTest00094.py", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "6d58cbd52ca9fc3034ee584df73a332dd800c7b05f78eeada7b2fce5468564ac", "sanitizedSha256": "c23327edcef3c0fc1e3c8017df45f892614053d99184cd5893424e6226678ace", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00620", "path": "testcode/BenchmarkTest00620.py", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "9b9fccb8bcc532fbfac2ae326052601a7ac254aa18593061f48288de83785815", "sanitizedSha256": "19af4b10ae41270b62704d05fb38fdb75b63418024f44b658ef31258705b8ca2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00588", "path": "testcode/BenchmarkTest00588.py", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "2097e8a4f2078e05af37d09e86842b5da07540c5cbb9b8f01d4b2ce3c74955ed", "sanitizedSha256": "e34bfe69619f47e35b068ca4c6b442826586bcd5bc311357a3e43ffcac9af56f", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00641", "path": "testcode/BenchmarkTest00641.py", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 59 ], "sourceSha256": "4fc4f18e551532d6e5c5770c3fd880e45ddfa640b2940640ea1314bc11866dc9", "sanitizedSha256": "8fa27d2ee4f2f54bc07603f9731b33630c96a973d1e4687565a76b5a4f316761", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00780", "path": "testcode/BenchmarkTest00780.py", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "4f30eabc02460c9ecc265a6eec4246c127a2a3f5737396caeed690f4433b3529", "sanitizedSha256": "86aaf74f87b7cfdb4cdc34e05fe84eed23ed2924d145fbea504bf45903e3ccbf", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest01047", "path": "testcode/BenchmarkTest01047.py", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 51 ], "sourceSha256": "6dccd0db84942c9c4e6f0f5409f5c17b59d7d9f44e1dac01f14742f424333dd4", "sanitizedSha256": "26b4f5645e2bc9e0aaceec1660e8a687795545000db6e35bf28f4f8374e8c37d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00152", "path": "testcode/BenchmarkTest00152.py", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 46 ], "sourceSha256": "a6d5fa4938575080e0fd8faa148ec54d7b9b7bd9ef497b786ca92b00a5d38b19", "sanitizedSha256": "da544e6f59d80088434136924e9cfc3294dc3d063fd65b9cc260ff774384280a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00497", "path": "testcode/BenchmarkTest00497.py", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 43 ], "sourceSha256": "1517d597c46bd244623bdbcb967aa74253336d18be567d17a5a6360184c5bc60", "sanitizedSha256": "250fdfaaa7a2cbe7b321c733d20830526030ee208fdd0a9b57f1b682f0a01fbd", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00660", "path": "testcode/BenchmarkTest00660.py", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "821b3e9b3a263dd794e91f54f4f21c22edbd6018244362e86421d81a02c0d0f1", "sanitizedSha256": "3215cbcad8c8b70aeae32061d63bfcfba112fa8738ed5eb5936a7f8017260968", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00898", "path": "testcode/BenchmarkTest00898.py", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "5c782040ab1d3e8d646b066db97acd6ff9e773d0678df2f5cb698e4f43e73c89", "sanitizedSha256": "7ece7e655428e4b5b0a23756f89b0c1b98506d5c51cb363094dd996cb451f29c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest01209", "path": "testcode/BenchmarkTest01209.py", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 52 ], "sourceSha256": "779b5c720bcb41995b43011dee489c78ff5ee09ffa55de38d3294606296a809a", "sanitizedSha256": "080ab63157fea0a652236be9ca752594696693b6894bf8453807e04f3306b553", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00068", "path": "testcode/BenchmarkTest00068.py", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "1787d21ef653eb0944bffd9be105d752d3f09c00be6ba34b3206e05fc479cf0d", "sanitizedSha256": "a3aace8bc3803c6c445aeab638942198fa613bd5d740e8d6241ff853308caf86", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00292", "path": "testcode/BenchmarkTest00292.py", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "de3a9938d7d30ece54248c7df2056c090c57b250637805fe61d066c1dd8d9399", "sanitizedSha256": "3a0aaa09e3b01c35120eb953c74e7b5eed5eaaa8fb4bcb1ea7b85f5403fe7c3e", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00541", "path": "testcode/BenchmarkTest00541.py", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 48, 50 ], "sourceSha256": "04a4794c16d853fa15c0b6b2194553d6d152c540511a79605557b447d826df17", "sanitizedSha256": "d4d103d429fb941ec3eff71bb10413ea2f775e3b313a1efcbdc9f6f776f56b66", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00415", "path": "testcode/BenchmarkTest00415.py", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 62, 63, 64, 65 ], "sourceSha256": "23e107c4b9ebcab6cc4f657ace95900cc7b7a5eb26feee839aacc12144ed6fd2", "sanitizedSha256": "92db41af40d6faf108a63a8dfa4a8cdadb76f82fb4d33fc2266aa22afb31aca2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00494", "path": "testcode/BenchmarkTest00494.py", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 57, 58, 59, 60 ], "sourceSha256": "978f1986c2920bd9dd0bd5b6703dbb2ad7265a5e1a378811cd6ee87db5747e80", "sanitizedSha256": "652848fd250683063d678bc40ab7f3e738f33d5463a15ebaf48f11635231df33", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 3 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00943", "path": "testcode/BenchmarkTest00943.py", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "fcc315f3aa65053fa6aee6e1d2f7954b5ec7d2157d18dfabb67ffc6658b2c22f", "sanitizedSha256": "959ec149bee3a3586f2e9431be7590d07b067aeee6126204a78b94cb02fa2a74", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00844", "path": "testcode/BenchmarkTest00844.py", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "b90be9de8a393bb2d4d1a12b83096f7a855df6f3955d7e6b0b20fb5f8863ed33", "sanitizedSha256": "9f8b24f1afd957380f0f3293f62542c5140f8344087d2c496d5173394088604b", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00512", "path": "testcode/BenchmarkTest00512.py", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 56 ], "sourceSha256": "6fea4f65eb817b5051660be2a3cdc3378356fc7a8aab31dda3cf8cc3b2f4015d", "sanitizedSha256": "51f8b86636d07663960930bb8d104216a30637425989014e9d451f541deeaaa5", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00511", "path": "testcode/BenchmarkTest00511.py", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 57 ], "sourceSha256": "60eb453e6e3ddcff7e1576e617c58fe4736cca9b736ae11e2c9a5489c95b08e1", "sanitizedSha256": "ae1042fa6ef12dcc0bfe15e5f51848e379e30f94fdefba340041da51be15b7b7", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00452", "path": "testcode/BenchmarkTest00452.py", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 43, 44, 45, 47 ], "sourceSha256": "3d46a83230d60675ba311acc08820590fb94b20e2c8cd1a12cbaf97ee74a14ea", "sanitizedSha256": "eb471b5429c061e8d71f27372c6bae7159c736b9a9b0d96e27efba1c00ba24da", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00841", "path": "testcode/BenchmarkTest00841.py", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 49, 50, 51, 53 ], "sourceSha256": "2c85fcc002dfa639dc9ad5e26f0b89f2b0bcfd718397cf54c2ffbb6f335e9dcc", "sanitizedSha256": "425294c7e17559bcdd034281fa3a302fe56538d3a82f2c1b4e2dbf81270a689d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00012", "path": "testcode/BenchmarkTest00012.py", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "fd90bac85ce2fe311dedb3372dc8ec4037dbe6de2d4955bcc89cdb56187cffd7", "sanitizedSha256": "88f82e23c6876c77323c0938d2680488b76c913646790f365ce5564a6f5ee09c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00099", "path": "testcode/BenchmarkTest00099.py", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "70a1ae553181b4ea78e6dec87c0c7ca73fdf1a9babbfeec062ea3465a8e64f8c", "sanitizedSha256": "2a8a3855f61181dc2261b7431fe6c24e7e89fe5a1e3da9f42e9485d7133fd7c8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00991", "path": "testcode/BenchmarkTest00991.py", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 60 ], "sourceSha256": "0d2015bf5a576c79c9c0d74d309a4cc8c1723b88d160230cf6802704604f5007", "sanitizedSha256": "dc41ace1485480328cce72e3c15e34a96eba89a732e0bb737c564215210a57e8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest01200", "path": "testcode/BenchmarkTest01200.py", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 45 ], "sourceSha256": "f3946bad750473f59f5840bd770f67c0bf4cc1769b66d31829596aec3fba0206", "sanitizedSha256": "c4e35c08ad100ca41a71c152ff38fdd0b60453edea6ff7f0b534343eb5d49824", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00818", "path": "testcode/BenchmarkTest00818.py", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 49 ], "sourceSha256": "03e86c5de51c8f0e9a01331571f53852b6d80405e23fccfbfd48ccb727650ee6", "sanitizedSha256": "643d34c01818b153a76f46edb92af152d79e8c563c732e766377bddef6aea8ac", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00161", "path": "testcode/BenchmarkTest00161.py", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 40 ], "sourceSha256": "5b7fff85449c25547a5beea20039187be606733bbbfef06d0ef431d896395a8b", "sanitizedSha256": "96804ff42dce0d994d41b825a8eba49452c5e5a38faa68a5724e461581beb802", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } } ], "servedCombinedPolicy": "Native deterministic findings are preserved and unioned with production-verified model findings using filterNovel. Model failures do not remove native positives and are not scored as safe negatives.", "usage": { "requests": 15, "tokens": 50816, "dollars": 0.0299076, "costUsdUpperBound": 0.0299076, "measuredPromptTokens": 34524, "measuredCompletionTokens": 16292, "unknownUsageRequests": 0, "latencyMs": 81380.074084, "accountingPolicy": "Configured peak cache-miss input and output upper bounds. Completion tokens include provider thinking tokens; cached-input discounts are not credited. Missing usage or interrupted attempts retain full reservation. Actual account billing is not independently verified." }, "providerModels": [ "deepseek-flash" ], "requests": [ { "requestSha256": "9d475bac20d55fbdf00beec13086e112f6d3e90b14b2d6bdfbdbe3a9a784c26f", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:40:22.766Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 15899.167292, "promptTokens": 12810, "completionTokens": 4087 }, { "requestSha256": "9b5d0d796063cfc94ebbb544671ef83afa8b0305106077cf1b62e7a1c1d3993c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:40:38.686Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6463.754459, "promptTokens": 1598, "completionTokens": 1176, "reasoningTokens": 978 }, { "requestSha256": "1ed9491a327c3b3fcfaa6ec3616b384c7eec12eb2293765014c66ec964e02d08", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:40:45.156Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 8570.737541999999, "promptTokens": 1549, "completionTokens": 1825, "reasoningTokens": 1644 }, { "requestSha256": "6b72dd5492f2597ba368bc2f6113bc5c884236958a43263e2a7b60e2937053da", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:40:53.737Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3594.0853330000027, "promptTokens": 1754, "completionTokens": 563, "reasoningTokens": 386 }, { "requestSha256": "635b27f140b269f8dac1ee94c7975fd780b6e221d1a223fef65b6bb0d3cba9b6", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:40:57.336Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2998.5777499999967, "promptTokens": 1685, "completionTokens": 537, "reasoningTokens": 368 }, { "requestSha256": "24956a79aaf1b519b362469e82f68877bef8bf2e9692c22574ca31c6dfc41bee", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:00.381Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2049.2747080000045, "promptTokens": 1583, "completionTokens": 366, "reasoningTokens": 176 }, { "requestSha256": "48d42d0753fe83a6c2e7ea301ead068aadcd915a6a2f646e74aaf71098c24e50", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:02.483Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 1758.2215419999993, "promptTokens": 1496, "completionTokens": 222, "reasoningTokens": 77 }, { "requestSha256": "e474991416e8b9124d12be08c3f2566a7c80b0a20f7d88ee7b22a40ac788f94f", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:04.253Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5910.284041999999, "promptTokens": 1479, "completionTokens": 1217, "reasoningTokens": 1022 }, { "requestSha256": "12c9036ecfa155c44588a48190d04faabe3ce70f379a509a02d5fa30a056201d", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:10.180Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2127.1538329999967, "promptTokens": 1545, "completionTokens": 292, "reasoningTokens": 156 }, { "requestSha256": "05cf84c8ff3dadbe9b7e67c5a3e3116080f403a5b1c4feecea86279948eafc1e", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:12.338Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2732.960124999998, "promptTokens": 1494, "completionTokens": 395, "reasoningTokens": 210 }, { "requestSha256": "6274c35b901092ac6cc54941eae1334402401d31a317bd0f18cb46016f7e7f42", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:15.083Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5786.446250000001, "promptTokens": 1517, "completionTokens": 1012, "reasoningTokens": 853 }, { "requestSha256": "6620c142934b6370f3dbc09f0a8b8b7ef9f6a6d0a38b29581227b02503d2fd7c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:20.881Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2110.3932080000013, "promptTokens": 1544, "completionTokens": 257, "reasoningTokens": 94 }, { "requestSha256": "c5da56bf6dc4a77be08330c7a0f65e4d0f338254e7090bd4f91f0f116eb074b9", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:23.000Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2483.5932079999984, "promptTokens": 1586, "completionTokens": 341, "reasoningTokens": 150 }, { "requestSha256": "4aabdbdbed3b00412eed26924e184894f61bd9a1555b6810a394037517df17c8", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:25.493Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 16530.430375000004, "promptTokens": 1522, "completionTokens": 3685, "reasoningTokens": 3496 }, { "requestSha256": "1f981e0defda5f6e6690982b771563671a4cf6247e86124928a3d2a9b4de95d1", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T02:41:42.038Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2364.994417000009, "promptTokens": 1362, "completionTokens": 317, "reasoningTokens": 130 } ], "diagnostics": { "BenchmarkTest00094": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 44, "endLine": 46 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00620": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 48, "endLine": 50 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ] }, "BenchmarkTest00588": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ] }, "BenchmarkTest00641": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyMapped": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 60 } ], "modelOnlyVerified": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 60 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 }, { "cwe": "CWE-327", "startLine": 59, "endLine": 60 } ] }, "BenchmarkTest00780": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest01047": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ] }, "BenchmarkTest00152": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00497": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ] }, "BenchmarkTest00660": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00898": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-502", "startLine": 48, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-502", "startLine": 48, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest01209": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00068": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 47, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 47, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest00292": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ] }, "BenchmarkTest00541": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "modelOnlyVerified": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ] }, "BenchmarkTest00415": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00494": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ], "modelOnlyMapped": [ { "cwe": "CWE-614", "startLine": 57, "endLine": 60 } ], "modelOnlyVerified": [ { "cwe": "CWE-614", "startLine": 57, "endLine": 60 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ] }, "BenchmarkTest00943": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-643", "startLine": 54, "endLine": 55 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00844": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "BenchmarkTest00512": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 53, "endLine": 56 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00511": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ] }, "BenchmarkTest00452": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00841": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] }, "BenchmarkTest00012": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00099": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ] }, "BenchmarkTest00991": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ] }, "BenchmarkTest01200": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 }, { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ] }, "BenchmarkTest00818": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 47, "endLine": 50 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ] }, "BenchmarkTest00161": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 39, "endLine": 40 } ], "modelOnlyVerified": [ { "cwe": "CWE-95", "startLine": 39, "endLine": 40 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-95", "startLine": 39, "endLine": 40 } ] } }, "gatingStats": [ { "batch": 1, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 1 } } ], "batching": { "maxFiles": null, "provenance": "Legacy single-batch protocol reconstruction", "batches": [ { "index": 1, "caseIds": [ "BenchmarkTest00094", "BenchmarkTest00620", "BenchmarkTest00588", "BenchmarkTest00641", "BenchmarkTest00780", "BenchmarkTest01047", "BenchmarkTest00152", "BenchmarkTest00497", "BenchmarkTest00660", "BenchmarkTest00898", "BenchmarkTest01209", "BenchmarkTest00068", "BenchmarkTest00292", "BenchmarkTest00541", "BenchmarkTest00415", "BenchmarkTest00494", "BenchmarkTest00943", "BenchmarkTest00844", "BenchmarkTest00512", "BenchmarkTest00511", "BenchmarkTest00452", "BenchmarkTest00841", "BenchmarkTest00012", "BenchmarkTest00099", "BenchmarkTest00991", "BenchmarkTest01200", "BenchmarkTest00818", "BenchmarkTest00161" ] } ] } }, "rerun": { "schemaVersion": 1, "protocolSha256": "36cd2c7e3b7e3ae0c01bcdbb5da8485d3db43c5f707e34178b15abd9e7a2d00d", "frozenAt": "2026-10-22T09:27:48.901Z", "startedAt": "2026-10-22T09:28:03.381Z", "finishedAt": "2026-10-22T09:30:32.817Z", "suite": { "name": "OWASP BenchmarkPython v0.1 balanced 28-case model detection-stage pilot", "repository": "https://github.com/OWASP-Benchmark/BenchmarkPython", "revision": "f1291485808b66e20ddb6b01b10dc71b3df8c8ba", "labelsSha256": "6396f37c97cfd0c018db3d8750095ce6c678a083f83620cfb3e88fe27a46bb0c", "totalCases": 1230 }, "config": { "model": "deepseek-v4-flash", "baseUrl": "https://api.deepseek.com", "concurrency": 1, "timeoutMs": 240000, "reasoningEffort": "none", "chainReasoningEffort": "low" }, "runtime": { "bun": "1.3.11", "node": "v24.3.0", "platform": "darwin", "arch": "arm64" }, "sourceIdentities": [ { "path": "apps/scan-cli/package.json", "sha256": "cc9d0ae3f24a0f1a2858e9ff0663c4804b88c77f8e2b8cf8a8b1082dc0e3d024" }, { "path": "apps/scan-cli/src/analysis-cache.ts", "sha256": "d0baba6157b77cf5cba8f8f6ac59d7929442ca9f144081b3622af80fac1f147f" }, { "path": "apps/scan-cli/src/analysisCoverage.ts", "sha256": "e3e0ba94e08f15d16db22214b3169798241d27ace83e9c2b3339ac2fde0f8ae4" }, { "path": "apps/scan-cli/src/appmodel.ts", "sha256": "11cb10ad4dc07e45360addf350638c231942a34c8a94cb56dffd687d40658f9c" }, { "path": "apps/scan-cli/src/batching.ts", "sha256": "4dbac39c710e1a5a661807c31dd1710d28f4554b5fb300541282eb38deb6e7cd" }, { "path": "apps/scan-cli/src/bench.ts", "sha256": "59b7870fc1cccd5925260c4912bfcc33b279c4dfd655e69cde689b23f59f9d12" }, { "path": "apps/scan-cli/src/benchmark-scorecard.ts", "sha256": "025b9f1a2fa845985d9fafbb6e84e6a39557eb73eba6064fcc2486b9a45979ee" }, { "path": "apps/scan-cli/src/cassette.ts", "sha256": "a811a8a9037156049094648cddb02ea0fd28938e4d5d7f9ba7a5d520d8ddb1c2" }, { "path": "apps/scan-cli/src/context.ts", "sha256": "26e02925eb5f20405171950bb35d20aaf71aa67eade8482ea70e4c89ced0ac1e" }, { "path": "apps/scan-cli/src/coverage.ts", "sha256": "10c0366ba24dfeb8792f4e1b817293186c6f1b6471cc4d01b2dc4096abc9e910" }, { "path": "apps/scan-cli/src/coverageReport.ts", "sha256": "e8eed15e9df0baefcd94ace34fcf0e63119e87ac4bea3595c2a279a060687a19" }, { "path": "apps/scan-cli/src/deepdive.ts", "sha256": "49c5913019358f87477bc93cab3daaa391beb8ebc307b55637d8f1c9234d8de9" }, { "path": "apps/scan-cli/src/deepseek.ts", "sha256": "b922cbf013b81ed1c3d682ce6e67868a3526034efd011ca6eb78dfc7e1ad8543" }, { "path": "apps/scan-cli/src/defences.ts", "sha256": "fb11f03b658d149a5e74bd8a18c74f27dc74aa24152d301703a1126c5723478f" }, { "path": "apps/scan-cli/src/depGraph.ts", "sha256": "b2e354315743883ed58cdcb22b3e242267e27ad3745ae11903f5d93c278be1f0" }, { "path": "apps/scan-cli/src/dependency-observations.ts", "sha256": "d8c14d1d944f1870602d35ec2d2e5b297e161423a0ed242256c60927b922f02a" }, { "path": "apps/scan-cli/src/depth.ts", "sha256": "aa01dd09689eb2cd271473b3628438951bc367a848807989a552cbf2d54fe1aa" }, { "path": "apps/scan-cli/src/envNames.ts", "sha256": "97071edd26823ab361d481785c04066eedabe6a5866c425562f089b4c7cc2c69" }, { "path": "apps/scan-cli/src/finding-response.ts", "sha256": "645faff3e3e6f9bd1d7bb7a7f93dab6bdb3f28787f08a6b97670193b5af1dc4a" }, { "path": "apps/scan-cli/src/fingerprint.ts", "sha256": "058ef82e52a20e2207d5c356bf8780a4bb8c02e88873be4bc079539c77225306" }, { "path": "apps/scan-cli/src/gates.ts", "sha256": "cc1f057e50be79d3fd397994dfc1df202812f05cf117b0145716c9c86d02e377" }, { "path": "apps/scan-cli/src/gitleaks.ts", "sha256": "3b45e13abb74de4f204acb29c82b3c8a3c6628373fe91c590bd4ea377f9bec38" }, { "path": "apps/scan-cli/src/helpers.ts", "sha256": "ae9c19d7ff10118b3089d4709a04f0cc749083dfe23d3e0c865b692ac32cc4b6" }, { "path": "apps/scan-cli/src/iac.ts", "sha256": "78011b64b0c4da54861405f19b9e33fe9f5b42f5c2108330c9fe46f17fd033ed" }, { "path": "apps/scan-cli/src/image.ts", "sha256": "a7aa4b3605587ec02c07116058a720c7b894b34b000598010f67061bbc9e2e22" }, { "path": "apps/scan-cli/src/imports.ts", "sha256": "37e654e1643d66d1b4b3dd08a71f029c85221f24bc1857a52f4c289e536de42a" }, { "path": "apps/scan-cli/src/independent-benchmark.ts", "sha256": "44d2a86c3e10ea7b897800dec90f7e73fd7096bc575c4fbdac50308a4561f242" }, { "path": "apps/scan-cli/src/index.ts", "sha256": "28244b9a65713e5d5f4e5a5581de5302372e1a5436870f1543dc5936805fd632" }, { "path": "apps/scan-cli/src/intelligence.ts", "sha256": "93bfb294b41bdf1616533ac6445c271430497e0def81e6443ef723c6a35efc90" }, { "path": "apps/scan-cli/src/kernel.ts", "sha256": "18f2d1eeeeacc4b528e343c91cae0b08bc6e252427e886af5470730d8774d4f0" }, { "path": "apps/scan-cli/src/logger.ts", "sha256": "3d53733daa48af057f2709b29af2d0e506af3f62764ea64cd1b5758be0ba8582" }, { "path": "apps/scan-cli/src/manifests.ts", "sha256": "bb1672c1bd3c1d399c16878572874efbe5e648e33b88e61455ba98b574d04af7" }, { "path": "apps/scan-cli/src/mapFinding.ts", "sha256": "be3ec1f53d70c7f6021ad695ffc37363e46d2dd34b047c14ade59dce2401459a" }, { "path": "apps/scan-cli/src/model-benchmark.ts", "sha256": "d1807991cb04db49daadc70df165a2c25b90ab33409168fa2b3b4d4feaf2b9c5" }, { "path": "apps/scan-cli/src/noise.ts", "sha256": "5d30d0453a93bd04a4bc10be6692d8a9813677dee35c7c3ba7af12ee7fb16bfa" }, { "path": "apps/scan-cli/src/oci.ts", "sha256": "c5600f5dbeb7e786ebcf0a75cf1d24c35314af3fcdcdc681feac7ad1154f7277" }, { "path": "apps/scan-cli/src/openapi.ts", "sha256": "6223b8611795454a8f0f52ec1f7bb577f19b144d41cb19dd226dc6c7168328c9" }, { "path": "apps/scan-cli/src/osdb.ts", "sha256": "cd464bb11b5953068934c17cde3f10bedaeaaed03fdf6d85cf267a2df0145e6b" }, { "path": "apps/scan-cli/src/prefilter.ts", "sha256": "53571e87886dbc160b0d64cac8a485c84d539c34e2a67bc07262350c2b83176f" }, { "path": "apps/scan-cli/src/prompts.ts", "sha256": "db36528333685d0972db8aae400b88a4e965e51a9ab7e4802725fb2bb41d6948" }, { "path": "apps/scan-cli/src/pullRequest.ts", "sha256": "2fbfa5525a0a9e9e0f9f35348429f397cc37bf22a897f779ea83e31a3d7c31bd" }, { "path": "apps/scan-cli/src/python-config.ts", "sha256": "cbd69945e59780938e88bbd3ba594696ad7c4fcfe00550e4a07102bd685e4065" }, { "path": "apps/scan-cli/src/python-flow.ts", "sha256": "ffc6d7325bbfefcc33b295998ee00ca3fb6fcf3af5df6391afff60a59ac34ade" }, { "path": "apps/scan-cli/src/quality.ts", "sha256": "7b69ff447ff7d673420eb84fc13c19b8b3a779f18bc01feb3c5c44166bcce40e" }, { "path": "apps/scan-cli/src/reachGraph.ts", "sha256": "099e451f8b1cf41d631d2831dba4629e4bc7ea0c31ce6b1291571e4f602dbd04" }, { "path": "apps/scan-cli/src/reachability.ts", "sha256": "fa01a82a0bca1a3ba67faca4f6fdc209fc0b81f099b59f70ead33dc6a1d5c24a" }, { "path": "apps/scan-cli/src/recovery.ts", "sha256": "c51f097dc8f7dfa1f0576c9c66fc459acb615122ad9e9d78b7ecad124b6c7e98" }, { "path": "apps/scan-cli/src/relatedSpans.ts", "sha256": "b455844c8a2dd2c8a91e56a291920ed34c7a3fb003c6cb285a82f2c5a92aaf2e" }, { "path": "apps/scan-cli/src/repoSecrets.ts", "sha256": "071dd5a1b259aa2cbf7adcd32b5a6010c69a8601711ae5a3f74117df35611d0f" }, { "path": "apps/scan-cli/src/reporter.ts", "sha256": "7c1ee9071898d0c47eb79c6542c7bd677933eda9f159f0dea9fcdcafc28bcbd6" }, { "path": "apps/scan-cli/src/repository-benchmark.ts", "sha256": "dc324cf0bf446082626a6bd31879782a6516149bd45d9293d7dbc519d7f08cb4" }, { "path": "apps/scan-cli/src/rule-defenses.ts", "sha256": "02e15e50eeefe594378f0cf7e9925d651df06561e64fe06365c7bcfdb3dcf1a1" }, { "path": "apps/scan-cli/src/rules.ts", "sha256": "4cd142f29398311478e0931f6f2cc0646d03d8f7448c423751927773996e4889" }, { "path": "apps/scan-cli/src/sbom.ts", "sha256": "2f76a139d11e49b67a826603881cbf81ffc4474bc4bd9fde6506e0c558c8f0d9" }, { "path": "apps/scan-cli/src/scan.ts", "sha256": "df65338708a1de4edb042b1bd3fbec79455c3b61ffabb8fba0caeff2a594e9e8" }, { "path": "apps/scan-cli/src/scanVersions.ts", "sha256": "5e3991039c32835b23767c90aafaa33ab15a6e61f7e01a9b0d3ab5683c602653" }, { "path": "apps/scan-cli/src/search.ts", "sha256": "f9db1c3b5fe9900a6e4f4335d53ada9083e2ae932ebcee853b56f527ba95f219" }, { "path": "apps/scan-cli/src/silence.ts", "sha256": "8c65ac7f0df90c9c15394ac6de861f86ce3d89a2930a8ebe7445d63eaa5e2787" }, { "path": "apps/scan-cli/src/spread.ts", "sha256": "2d80502b0d1b0d453aa0e2da7513fefdf75755a37d5af1e3cf6a5cb08b12d9d0" }, { "path": "apps/scan-cli/src/stability.ts", "sha256": "61012aae5957361f46a8f15413ea429e7350fefabce4e9e0e6fa972278cc34e7" }, { "path": "apps/scan-cli/src/stop.ts", "sha256": "d35e4491a63e6792342b8b5deea342a2b4bbe22975aeb6f26c51537e2275fd6f" }, { "path": "apps/scan-cli/src/sweep.ts", "sha256": "1c51efc21e15e6fa3bbf1b5d3b7504e7aed497a507abe5182397c1250252ce55" }, { "path": "apps/scan-cli/src/tar.ts", "sha256": "2c80b52c78e9c75185ed90b3cd4f4a6bca969fe0d1c736f15f8b72e47773e6f6" }, { "path": "apps/scan-cli/src/template-flow.ts", "sha256": "435188aca557af792af85cb0553cac1361e075e2d3e007f8963b2e399810469b" }, { "path": "apps/scan-cli/src/tools.ts", "sha256": "cf9de13aa44e1550fdeedfba7e25ac7ccf36b289825a8eaf3f1928cf8b5df3d8" }, { "path": "apps/scan-cli/src/trivy.ts", "sha256": "150153c1b23996bc0f8a32301c65d0bff0be1fa2fae6cb7eb0f5c581c700c236" }, { "path": "apps/scan-cli/src/verdict-contract.ts", "sha256": "e24ab43d9f4cc96ebd2e3948286779b2e0b0390f42106f14b3b7eef3bcee9d61" }, { "path": "apps/scan-cli/src/verify.ts", "sha256": "a107310a1f21fff33e0642c492bd368858c4c46da73dedebfdf480f4931b8bfe" }, { "path": "apps/scan-cli/src/walk.ts", "sha256": "3d2a350dfe6e25403e50eefa3a0dbaebe275b422950717fc438be3bd5c74d097" }, { "path": "bun.lock", "sha256": "14b55bb0ae964bab83edb70d146e5e5eac16a7ef7418b4bd94842a5335edbbbd" }, { "path": "package.json", "sha256": "0c61121892bbd320487234c977f0e12f550a611adcb621d86d138c60cf0f6422" }, { "path": "packages/schemas/package.json", "sha256": "a46ecb31aa9aa33ceb6daafae8394ccdfa228fc7789198c421a02c0999aaa786" }, { "path": "packages/schemas/src/billing.ts", "sha256": "7ae419533da6bc2a20ad243b33b452dcd25d7dd67fe6c4b89c7d44193818322e" }, { "path": "packages/schemas/src/careers.ts", "sha256": "c367f27b05dfdc9d57e25fe9987bf21e78f3f65ea9556afccea999cbfc068c46" }, { "path": "packages/schemas/src/dependencyObservations.ts", "sha256": "d5a641b059b22592c692d3283502b9d77213ec42e77e03e600d0a20ee72d4038" }, { "path": "packages/schemas/src/findings.ts", "sha256": "a12c3448f1e41d2eda5313f9b9a8fcf64ed2b77ebc80e5e22a7c682060878a38" }, { "path": "packages/schemas/src/immunity.ts", "sha256": "cbe2557cc42d164e9d677f92ab8e26ce12762b4b2f60d5a3f2430b59a793abce" }, { "path": "packages/schemas/src/index.ts", "sha256": "dc8572d1089083d76301bdf8634bfe9565973f00e6cc49beca1101df17ec4cbe" }, { "path": "packages/schemas/src/investigation.ts", "sha256": "0a4a6a4370ff428910b2fb0ef53450fae064392dc58e341f8eb33da2252300b5" }, { "path": "packages/schemas/src/ir.ts", "sha256": "c1b1d0766b20e4830a9a6ab35d27ba16dc676f9a4c2a9badebd4fdbd17919df8" }, { "path": "packages/schemas/src/knowledge.ts", "sha256": "74488c0199366e71df6c2a83e71333317392e6b010e88f6beb66b935cec4bc85" }, { "path": "packages/schemas/src/notifications.ts", "sha256": "994d00573e810665c4379c2cb86147d28ac588ffca1b7f5c305cbd3ee98578c9" }, { "path": "packages/schemas/src/packages.ts", "sha256": "cabe240416e6c35be7baae9e776017e272f03efc5c4bcac3db05b3c11fa75d7e" }, { "path": "packages/schemas/src/proof.ts", "sha256": "80dcb156960b75ec0dee7e607fba08229ddc0cccb5c8951e813274b27340953f" }, { "path": "packages/schemas/src/reachability.ts", "sha256": "6f78887ccf9f09df85e9cad8b5c271fd036782846bcdd301de44e85645f86b39" }, { "path": "packages/schemas/src/reproduction.ts", "sha256": "ef08346d379d5f325bd579a7536679fef7d09fab7f4925392c55c55fd3aa7ab5" }, { "path": "packages/schemas/src/scanCompletion.ts", "sha256": "881dd9263b32be386c364e8595562cadf7e9cbda9efe5aa64abac11b798c7e8f" }, { "path": "packages/schemas/src/scanPullRequest.ts", "sha256": "09e56c5771b087884f735f69a3f3cb625f99e7aab1a867fd1f469fd1906ba2b6" }, { "path": "packages/schemas/src/scanReasons.ts", "sha256": "fba539e6d3c2140db2a329a6be9ce53e7ed0f6dc4437f085d2ce014be71d200a" }, { "path": "packages/schemas/src/secretRepair.ts", "sha256": "f139123f488ba9a19e2a22bcd02544986d0e056358876a3db51655f7d5a99be2" }, { "path": "packages/schemas/src/secrets.ts", "sha256": "e3a898bcadcbc68d0587b513db1d1945174437f358e0fe33624e97df50b42c00" }, { "path": "packages/schemas/src/security.ts", "sha256": "311afcee8ce9a869a622a19e2b1db1e57e003ace1f655921760ec21689a46f44" }, { "path": "packages/schemas/src/states.ts", "sha256": "540c39ae578d9f7cae4ab84e5e183852e6eb84ae49d1d992c2cbf8c2e81a66b6" }, { "path": "packages/schemas/src/wire.ts", "sha256": "b0c21292deadef07a17133b79eb89e4d3dc3dd6bfd165f61653efb699d9d6c3d" }, { "path": "packages/schemas/src/workspace.ts", "sha256": "17a5fab2b0f41f698fbe2f1eceb055c035ae04bec35f547c03531d2e0eefbf42" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/rule.yaml", "sha256": "add1d0987ffcb76cf8286d4da2210674893a8a8c693c9afacb5f4adbbfc7f73d" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/safe/sanitized_html.ts", "sha256": "0d602cd9ae708c8060652de16f1c361a5522dc81d81624e8bdaaaae2664457d2" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/vulnerable/bypass_trust_html.ts", "sha256": "dda816ef1b3d98aa23f109516466c901b66bee2cc3c4742f997ddbf75dac2165" }, { "path": "rulepacks/common/CLEARTEXT-001/rule.yaml", "sha256": "19d83cbe5fabd840248811236a6426d860695cc99d57105d7f67d71b46cfb809" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/safe/https_endpoint.ts", "sha256": "c497ad77c81fd53d387c2b5b10161388c87628740d0b678891581d330ab1ca03" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/vulnerable/ftp_endpoint.ts", "sha256": "c3a6c3a828cc4cdca45bbdf486c6c2856066163884baa74f760a91e896f11870" }, { "path": "rulepacks/common/CMDI-001/rule.yaml", "sha256": "76a524d4596595bec3d2b8550e593f8f73b2c463c594bb7a70f2cb8c3ea9346c" }, { "path": "rulepacks/common/CODE-001/rule.yaml", "sha256": "313aa196ab864dd25536b018605c1c3b36f18956a367376ee0e005bb319f58be" }, { "path": "rulepacks/common/CODE-001/tests/safe/comment_mentions_eval.ts", "sha256": "a47f8173953238cb60d08856a1b037366fbe536a88da34b23c643e9cad35d572" }, { "path": "rulepacks/common/CODE-001/tests/safe/literal_mentions_eval.ts", "sha256": "3d09dab28d07ba35d263943091655822f5f5d217b2d6fccbbf3f9cb435bacfc2" }, { "path": "rulepacks/common/CODE-001/tests/vulnerable/eval_query.ts", "sha256": "e3f4f0d3c518040aa2696ea7f76ff19db67601d38be08b42373615b3ded3dae0" }, { "path": "rulepacks/common/DESER-001/rule.yaml", "sha256": "20b2f7b0d2b0a0dbf7d8725589a031e8d7cb58d318d151d099bfc1c2e484dd79" }, { "path": "rulepacks/common/DESER-001/tests/safe/yaml_safe_load.ts", "sha256": "7aaaf0beb687fdadfafbc7d6d1a952647353a222571032ea59242f87bf33dba9" }, { "path": "rulepacks/common/DESER-001/tests/vulnerable/yaml_load_body.ts", "sha256": "f108c65e1710a394fa1785691e1cb6d621e3e0b778da96403788137e3156453a" }, { "path": "rulepacks/common/PATH-001/rule.yaml", "sha256": "b45b1cfe6d8c5af96ec1e8a1c837feeb8ddc239424adca3c188a64c161a00d2f" }, { "path": "rulepacks/common/PATH-001/tests/safe/read_normalized_path.ts", "sha256": "de57b93ba7c7f086a1a9de7d2872628ccb63d84da3fb2fa1ef195bf58b0d2ca6" }, { "path": "rulepacks/common/PATH-001/tests/safe/template_allowlisted.ts", "sha256": "d1d539bba782f1be978bfc1758690d38426278adaf1a44dbf76705e47ce6618b" }, { "path": "rulepacks/common/PATH-001/tests/vulnerable/read_user_path.ts", "sha256": "f1b1f2b69e5992f4004d8a30d0e696fb19d21cd1cb02927e61687e5991d7569d" }, { "path": "rulepacks/common/REDIR-001/rule.yaml", "sha256": "ebaba25880fec0039dad28bd24cbdd36541ab08036ce72527d31363ba37551f7" }, { "path": "rulepacks/common/REDIR-001/tests/safe/redirect_allowlist.ts", "sha256": "903c9879c7b4b35624849633a17e8a34a86dc25f4526cc3df5342b5bb0e49bde" }, { "path": "rulepacks/common/REDIR-001/tests/vulnerable/open_redirect.ts", "sha256": "efd4e225c944fb8647054fa952e40f0d6f3b3b905e22a6bf89f4b2c310daf363" }, { "path": "rulepacks/common/SQLI-001/rule.yaml", "sha256": "3e64945a2e853ae7bbd868a110edbca234966a170a03f3dfe6f49de7077c6fcc" }, { "path": "rulepacks/common/SQLI-001/tests/safe/drizzle_where.ts", "sha256": "106f09d70c246f993c7098b5d059bea9b836d1d025154d2c21b2b330519e7ceb" }, { "path": "rulepacks/common/SQLI-001/tests/safe/identifier_allowlist.ts", "sha256": "bca1e858b9fda6aff77dc1334c96e61446966250ab503c5832c0ef2919ce8436" }, { "path": "rulepacks/common/SQLI-001/tests/safe/parameterized_query.ts", "sha256": "bc711ba097116beaedf72e93c7b3b20b961a2d1258948ecb0dbe6e0ab8831a4c" }, { "path": "rulepacks/common/SQLI-001/tests/vulnerable/concat_query.ts", "sha256": "a2429d8b1f611d41495a356ac305368dc5b78092e491a43bedf6a0f663b6ecb8" }, { "path": "rulepacks/common/SSRF-001/rule.yaml", "sha256": "86bbbbd1f8bfe819cb8af8bde8ca5e43e038979c728fa8ad030641777a631f3e" }, { "path": "rulepacks/common/SSRF-001/tests/safe/express_proxy_allowlist.ts", "sha256": "571f26fc750cdb14b72c7803cd2dd50d62acd806d1677dd5165aa92060ecd21f" }, { "path": "rulepacks/common/SSRF-001/tests/vulnerable/express_proxy.ts", "sha256": "e4f646374bcb08c30fb8af627a91668f4841512cebe1bf804f79c0c4cc2229ab" }, { "path": "rulepacks/common/SSTI-001/rule.yaml", "sha256": "1cf2a5878dad69f9adf9cad88ea2000064898a51447e053a47ef05581954edde" }, { "path": "rulepacks/common/SSTI-001/tests/safe/precompiled_template.ts", "sha256": "0d5febf5ff8f2070115eaeba0870cdfcd392a2dd142487f0a996b04cc491a6e1" }, { "path": "rulepacks/common/SSTI-001/tests/vulnerable/handlebars_compile.ts", "sha256": "4b04998aa32236b06404c7c9aaf2674d01173576b2401efd4904166a4f30fd5f" }, { "path": "rulepacks/common/UPLOAD-001/rule.yaml", "sha256": "e5d8812fab296e63bb94fed6486797995e830fd2feedb5e4ac567bb7e904600b" }, { "path": "rulepacks/common/UPLOAD-001/tests/safe/mime_checked_upload.ts", "sha256": "e020db518e233ac8433f5237c1744d70d6854bd802dbd232f6377d1e03c9aa77" }, { "path": "rulepacks/common/UPLOAD-001/tests/vulnerable/unchecked_upload.ts", "sha256": "c2c4629e3af2db831f72d99572b49c758174bb224e4a2f4abb88ab82f12a3967" }, { "path": "rulepacks/common/XSS-001/rule.yaml", "sha256": "4eafa1e0a5329f76ec075e03d6bf756570cd1643ec4b1aaff9f4ae8960073237" }, { "path": "rulepacks/common/XSS-001/tests/safe/escaped_html.ts", "sha256": "199162c065905fc36a12bae5eedef52093de52b6faea7189b26c94fc4b297fd0" }, { "path": "rulepacks/common/XSS-001/tests/vulnerable/inner_html.ts", "sha256": "9bc3e7f70495dec60e4fae6e44c6525d1f7eed9eaab34f1b7f0c2f62ee334865" }, { "path": "rulepacks/javascript/CMDI-002/rule.yaml", "sha256": "ec140652bbbf75b9ac7abf0491617a7b2fedafec6b01e061afcc455fd46dfab2" }, { "path": "rulepacks/javascript/CODE-002/rule.yaml", "sha256": "5fba2995a7c08491b7fce10659cff11e00d9197bf59a5d3a38f93403ca398b63" }, { "path": "rulepacks/javascript/PATH-002/rule.yaml", "sha256": "6cd1dcc2bd021b507e56eda1048e2d556a7f2d63e174a387c55654dfd32b2fc1" }, { "path": "rulepacks/javascript/PROTO-001/rule.yaml", "sha256": "bf376e71fc05a878df13da0e52dad459fb0c3fd64022d8a69733f3714f6c0ee7" }, { "path": "rulepacks/javascript/PROTO-002/rule.yaml", "sha256": "a33eb6189979feb4815736b9b41878181409cb6582bcbc84cf8b570a8ca6fdde" }, { "path": "rulepacks/javascript/REDOS-001/rule.yaml", "sha256": "b20709f91bfe5bc2b834174a53fb2d0aa2772fd21838191273c117a662d7fbbc" }, { "path": "rulepacks/javascript/REDOS-002/rule.yaml", "sha256": "96c5b0ca1b87ccfd62d47a5cdf0333b9aeb8af676e57db2cb1bf51071a01f128" }, { "path": "rulepacks/javascript/REDOS-003/rule.yaml", "sha256": "1cc53d782185aed8c25f674342c6e25c26bf4fe7d28c11149cd7d4e6c00591b1" }, { "path": "rulepacks/javascript/REDOS-004/rule.yaml", "sha256": "4fc5fa489991681c7b6c7c8fdab2271f0e482c5bdf65cbdb1a5ed14fcc79fefa" }, { "path": "rulepacks/javascript/XSS-002/rule.yaml", "sha256": "265b5dddc5503e3cfede82589a20346e7111aee234aae699bd72010284ab4819" }, { "path": "rulepacks/python/COOKIE-001/rule.yaml", "sha256": "e96b7b90b587fa6d110a094a04a62e892ea7c3e568dc3348cb91152dc31b28eb" }, { "path": "rulepacks/python/DESER-002/rule.yaml", "sha256": "a77cd0730f50c608ddaa4d8446adb7b728522990b1cd772a96648113e522c731" }, { "path": "rulepacks/python/HASH-001/rule.yaml", "sha256": "e73bc710813e3432d33ebd5c3009af465ff431828a6f62023f8134284cb2952c" }, { "path": "rulepacks/python/LDAP-001/rule.yaml", "sha256": "ba5af874b16aced31442688c2696bdce5d653e06777cb8405ba4827fe81299d9" }, { "path": "rulepacks/python/PYEXEC-001/rule.yaml", "sha256": "e894bf53024edc28c99465d76e0ba6cf0041a365c3e47d886f8fa2d4bb9d978f" }, { "path": "rulepacks/python/RANDOM-001/rule.yaml", "sha256": "cc5ef82221e457cd3735ddf1a2460f0ad1b4c0a42d8d046dc6eb8826c8a4401e" }, { "path": "rulepacks/python/SQLI-002/rule.yaml", "sha256": "8870d9e0c8e50ef1e98bdd0a5d340a993fd08bb79c99b83ab0d5d428532efd3c" }, { "path": "rulepacks/python/SSTI-002/rule.yaml", "sha256": "9eaef2a4dd0a2a05427b38d57224363493ae4d6084de444cb972abe363b4a7e5" }, { "path": "rulepacks/python/TRUST-001/rule.yaml", "sha256": "951696eaf7ece7422b37a1fa86d5985f8d3b128d583ce50df98520a877896372" }, { "path": "rulepacks/python/XPATH-001/rule.yaml", "sha256": "17604e33d66d6d7e378932a5979beba8bd09166a0c9bb9fe298cd448ba34d43b" }, { "path": "rulepacks/python/XXE-001/rule.yaml", "sha256": "560eadedab50b15f003f19895559b947ef17958200940ab1099a351b3278bc4d" } ], "selection": { "seed": "cefense-model-stage-pilot-2026-10-21:", "procedure": "Partition all 1230 author-labelled cases by exact expected CWE and vulnerable boolean. Select minimum SHA-256(seed + original case ID) in each of 28 strata. No detector predictions used. Manually inspect selected source before any model inference and declare security operation statement lines. Keep author labels without adjudication.", "selectedCases": 28, "corpusCases": 1230, "unselectedCases": 1202, "caseManifestSha256": "f553622a791a8376dcc78b1dd2e85fe00b89f83b428431b1ccdf546cfb790f1a", "caseIds": [ "BenchmarkTest00094", "BenchmarkTest00620", "BenchmarkTest00588", "BenchmarkTest00641", "BenchmarkTest00780", "BenchmarkTest01047", "BenchmarkTest00152", "BenchmarkTest00497", "BenchmarkTest00660", "BenchmarkTest00898", "BenchmarkTest01209", "BenchmarkTest00068", "BenchmarkTest00292", "BenchmarkTest00541", "BenchmarkTest00415", "BenchmarkTest00494", "BenchmarkTest00943", "BenchmarkTest00844", "BenchmarkTest00512", "BenchmarkTest00511", "BenchmarkTest00452", "BenchmarkTest00841", "BenchmarkTest00012", "BenchmarkTest00099", "BenchmarkTest00991", "BenchmarkTest01200", "BenchmarkTest00818", "BenchmarkTest00161" ], "sinkReview": "Read all 28 selected source post handlers. Anchors identify file reads/writes, digest/token creation, session assignment, parser configuration and parse, cookie security arguments, XPath/SQL/LDAP/command execution, returned HTML construction, or eval/exec. No engine predictions used." }, "plan": { "mode": "default", "maxRounds": 1, "sweepEffort": "none", "verifyEffort": "low", "verifyEnabled": true, "minConfidence": 0.4, "absenceLane": true, "spread": false, "secondOpinion": false, "verifyEngineFindings": false }, "limits": { "requests": 80, "tokens": 600000, "dollars": 0.42 }, "scope": "Production detection-stage prompt, snippet mapping gates, configured verification and native union policy. Selected source files only, with imported helper bodies absent. No intelligence retrieval, repository execution, additional sweep/absence/spread/chain lanes, PR generation or full hosted scan. Public label-known corpus, not independent held-out accuracy. Labels and suite identifiers are not model messages. Native findings are never deleted by model review.", "targetPlatform": "unknown", "prices": { "inputUsdPerMillion": 0.3, "outputUsdPerMillion": 1.2, "source": "https://api-docs.deepseek.com/quick_start/pricing/", "checkedAt": "2026-10-22T09:27:48.863Z" }, "planned": 28, "corpusCases": 1230, "unselectedCases": 1202, "scores": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 7, "fn": 7, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 7, "fn": 7, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 } }, "cases": [ { "id": "BenchmarkTest00094", "path": "testcode/BenchmarkTest00094.py", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "6d58cbd52ca9fc3034ee584df73a332dd800c7b05f78eeada7b2fce5468564ac", "sanitizedSha256": "c23327edcef3c0fc1e3c8017df45f892614053d99184cd5893424e6226678ace", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00620", "path": "testcode/BenchmarkTest00620.py", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "9b9fccb8bcc532fbfac2ae326052601a7ac254aa18593061f48288de83785815", "sanitizedSha256": "19af4b10ae41270b62704d05fb38fdb75b63418024f44b658ef31258705b8ca2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00588", "path": "testcode/BenchmarkTest00588.py", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "2097e8a4f2078e05af37d09e86842b5da07540c5cbb9b8f01d4b2ce3c74955ed", "sanitizedSha256": "e34bfe69619f47e35b068ca4c6b442826586bcd5bc311357a3e43ffcac9af56f", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00641", "path": "testcode/BenchmarkTest00641.py", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 59 ], "sourceSha256": "4fc4f18e551532d6e5c5770c3fd880e45ddfa640b2940640ea1314bc11866dc9", "sanitizedSha256": "8fa27d2ee4f2f54bc07603f9731b33630c96a973d1e4687565a76b5a4f316761", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00780", "path": "testcode/BenchmarkTest00780.py", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "4f30eabc02460c9ecc265a6eec4246c127a2a3f5737396caeed690f4433b3529", "sanitizedSha256": "86aaf74f87b7cfdb4cdc34e05fe84eed23ed2924d145fbea504bf45903e3ccbf", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest01047", "path": "testcode/BenchmarkTest01047.py", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 51 ], "sourceSha256": "6dccd0db84942c9c4e6f0f5409f5c17b59d7d9f44e1dac01f14742f424333dd4", "sanitizedSha256": "26b4f5645e2bc9e0aaceec1660e8a687795545000db6e35bf28f4f8374e8c37d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00152", "path": "testcode/BenchmarkTest00152.py", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 46 ], "sourceSha256": "a6d5fa4938575080e0fd8faa148ec54d7b9b7bd9ef497b786ca92b00a5d38b19", "sanitizedSha256": "da544e6f59d80088434136924e9cfc3294dc3d063fd65b9cc260ff774384280a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00497", "path": "testcode/BenchmarkTest00497.py", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 43 ], "sourceSha256": "1517d597c46bd244623bdbcb967aa74253336d18be567d17a5a6360184c5bc60", "sanitizedSha256": "250fdfaaa7a2cbe7b321c733d20830526030ee208fdd0a9b57f1b682f0a01fbd", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00660", "path": "testcode/BenchmarkTest00660.py", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "821b3e9b3a263dd794e91f54f4f21c22edbd6018244362e86421d81a02c0d0f1", "sanitizedSha256": "3215cbcad8c8b70aeae32061d63bfcfba112fa8738ed5eb5936a7f8017260968", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00898", "path": "testcode/BenchmarkTest00898.py", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "5c782040ab1d3e8d646b066db97acd6ff9e773d0678df2f5cb698e4f43e73c89", "sanitizedSha256": "7ece7e655428e4b5b0a23756f89b0c1b98506d5c51cb363094dd996cb451f29c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest01209", "path": "testcode/BenchmarkTest01209.py", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 52 ], "sourceSha256": "779b5c720bcb41995b43011dee489c78ff5ee09ffa55de38d3294606296a809a", "sanitizedSha256": "080ab63157fea0a652236be9ca752594696693b6894bf8453807e04f3306b553", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00068", "path": "testcode/BenchmarkTest00068.py", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "1787d21ef653eb0944bffd9be105d752d3f09c00be6ba34b3206e05fc479cf0d", "sanitizedSha256": "a3aace8bc3803c6c445aeab638942198fa613bd5d740e8d6241ff853308caf86", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00292", "path": "testcode/BenchmarkTest00292.py", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "de3a9938d7d30ece54248c7df2056c090c57b250637805fe61d066c1dd8d9399", "sanitizedSha256": "3a0aaa09e3b01c35120eb953c74e7b5eed5eaaa8fb4bcb1ea7b85f5403fe7c3e", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00541", "path": "testcode/BenchmarkTest00541.py", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 48, 50 ], "sourceSha256": "04a4794c16d853fa15c0b6b2194553d6d152c540511a79605557b447d826df17", "sanitizedSha256": "d4d103d429fb941ec3eff71bb10413ea2f775e3b313a1efcbdc9f6f776f56b66", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00415", "path": "testcode/BenchmarkTest00415.py", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 62, 63, 64, 65 ], "sourceSha256": "23e107c4b9ebcab6cc4f657ace95900cc7b7a5eb26feee839aacc12144ed6fd2", "sanitizedSha256": "92db41af40d6faf108a63a8dfa4a8cdadb76f82fb4d33fc2266aa22afb31aca2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00494", "path": "testcode/BenchmarkTest00494.py", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 57, 58, 59, 60 ], "sourceSha256": "978f1986c2920bd9dd0bd5b6703dbb2ad7265a5e1a378811cd6ee87db5747e80", "sanitizedSha256": "652848fd250683063d678bc40ab7f3e738f33d5463a15ebaf48f11635231df33", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 3 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00943", "path": "testcode/BenchmarkTest00943.py", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "fcc315f3aa65053fa6aee6e1d2f7954b5ec7d2157d18dfabb67ffc6658b2c22f", "sanitizedSha256": "959ec149bee3a3586f2e9431be7590d07b067aeee6126204a78b94cb02fa2a74", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00844", "path": "testcode/BenchmarkTest00844.py", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "b90be9de8a393bb2d4d1a12b83096f7a855df6f3955d7e6b0b20fb5f8863ed33", "sanitizedSha256": "9f8b24f1afd957380f0f3293f62542c5140f8344087d2c496d5173394088604b", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00512", "path": "testcode/BenchmarkTest00512.py", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 56 ], "sourceSha256": "6fea4f65eb817b5051660be2a3cdc3378356fc7a8aab31dda3cf8cc3b2f4015d", "sanitizedSha256": "51f8b86636d07663960930bb8d104216a30637425989014e9d451f541deeaaa5", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00511", "path": "testcode/BenchmarkTest00511.py", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 57 ], "sourceSha256": "60eb453e6e3ddcff7e1576e617c58fe4736cca9b736ae11e2c9a5489c95b08e1", "sanitizedSha256": "ae1042fa6ef12dcc0bfe15e5f51848e379e30f94fdefba340041da51be15b7b7", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00452", "path": "testcode/BenchmarkTest00452.py", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 43, 44, 45, 47 ], "sourceSha256": "3d46a83230d60675ba311acc08820590fb94b20e2c8cd1a12cbaf97ee74a14ea", "sanitizedSha256": "eb471b5429c061e8d71f27372c6bae7159c736b9a9b0d96e27efba1c00ba24da", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00841", "path": "testcode/BenchmarkTest00841.py", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 49, 50, 51, 53 ], "sourceSha256": "2c85fcc002dfa639dc9ad5e26f0b89f2b0bcfd718397cf54c2ffbb6f335e9dcc", "sanitizedSha256": "425294c7e17559bcdd034281fa3a302fe56538d3a82f2c1b4e2dbf81270a689d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00012", "path": "testcode/BenchmarkTest00012.py", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "fd90bac85ce2fe311dedb3372dc8ec4037dbe6de2d4955bcc89cdb56187cffd7", "sanitizedSha256": "88f82e23c6876c77323c0938d2680488b76c913646790f365ce5564a6f5ee09c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00099", "path": "testcode/BenchmarkTest00099.py", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "70a1ae553181b4ea78e6dec87c0c7ca73fdf1a9babbfeec062ea3465a8e64f8c", "sanitizedSha256": "2a8a3855f61181dc2261b7431fe6c24e7e89fe5a1e3da9f42e9485d7133fd7c8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00991", "path": "testcode/BenchmarkTest00991.py", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 60 ], "sourceSha256": "0d2015bf5a576c79c9c0d74d309a4cc8c1723b88d160230cf6802704604f5007", "sanitizedSha256": "dc41ace1485480328cce72e3c15e34a96eba89a732e0bb737c564215210a57e8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest01200", "path": "testcode/BenchmarkTest01200.py", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 45 ], "sourceSha256": "f3946bad750473f59f5840bd770f67c0bf4cc1769b66d31829596aec3fba0206", "sanitizedSha256": "c4e35c08ad100ca41a71c152ff38fdd0b60453edea6ff7f0b534343eb5d49824", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00818", "path": "testcode/BenchmarkTest00818.py", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 49 ], "sourceSha256": "03e86c5de51c8f0e9a01331571f53852b6d80405e23fccfbfd48ccb727650ee6", "sanitizedSha256": "643d34c01818b153a76f46edb92af152d79e8c563c732e766377bddef6aea8ac", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00161", "path": "testcode/BenchmarkTest00161.py", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 40 ], "sourceSha256": "5b7fff85449c25547a5beea20039187be606733bbbfef06d0ef431d896395a8b", "sanitizedSha256": "96804ff42dce0d994d41b825a8eba49452c5e5a38faa68a5724e461581beb802", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } } ], "servedCombinedPolicy": "Native deterministic findings are preserved and unioned with production-verified model findings using filterNovel. Model failures do not remove native positives and are not scored as safe negatives.", "usage": { "requests": 20, "tokens": 76128, "dollars": 0.0495486, "costUsdUpperBound": 0.0495486, "measuredPromptTokens": 46450, "measuredCompletionTokens": 29678, "unknownUsageRequests": 0, "latencyMs": 148213.640294, "accountingPolicy": "Configured peak cache-miss input and output upper bounds. Completion tokens include provider thinking tokens; cached-input discounts are not credited. Missing usage or interrupted attempts retain full reservation. Actual account billing is not independently verified." }, "providerModels": [ "deepseek-flash" ], "requests": [ { "requestSha256": "4418891b9e37b1b0b39577bcc39b89509d99beb25a71201f7b29941f985363b0", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:03.605Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 8297.61825, "promptTokens": 5630, "completionTokens": 1643 }, { "requestSha256": "965b198b4c2991cf6ae08b2646f7ca6d656fb0c704a910248a9b92ba2157944c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:11.994Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 14699.858750000001, "promptTokens": 1728, "completionTokens": 2953, "reasoningTokens": 2695 }, { "requestSha256": "8fa6a8e5b55a389786aa4de4b5f831b8e3598052ab17efdfc71b02fa50e25e63", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:26.724Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5078.982333, "promptTokens": 1569, "completionTokens": 935, "reasoningTokens": 766 }, { "requestSha256": "2f2a5ef974fa3f2ba8719a3ac2b01b970aafd6e7e27a42e2c4cf1b5889f840ff", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:31.823Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6665.376791999999, "promptTokens": 1644, "completionTokens": 1242, "reasoningTokens": 1036 }, { "requestSha256": "52608af68b560431253fcbf5e8a74b564cab1d38f3ae219633a0750eaa8ccdc7", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:38.491Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 15042.819875000001, "promptTokens": 1607, "completionTokens": 2818, "reasoningTokens": 2662 }, { "requestSha256": "53f3ca5781fecc5c25e9cf557781986863b34cbc9fa3d885cf07fda86341bf64", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:53.538Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3764.4971250000017, "promptTokens": 1864, "completionTokens": 650, "reasoningTokens": 539 }, { "requestSha256": "8c7340029df89e5b40a0ef1133fe09e38c6ee958bcef4b6d834eab2478205745", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:57.598Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2029.9719169999953, "promptTokens": 1707, "completionTokens": 296, "reasoningTokens": 131 }, { "requestSha256": "7789bfda093b8b0f25fbee139d75586490d05474be96079c257d3ed19d5824a6", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:28:59.676Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2237.6545419999966, "promptTokens": 5569, "completionTokens": 278 }, { "requestSha256": "2e7d358cf9362637bbfcd8fe1febffe54401139ea3b1d4007aff8601f3ee0d49", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:01.957Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 1960.019917000005, "promptTokens": 1743, "completionTokens": 254, "reasoningTokens": 91 }, { "requestSha256": "8d59a7114410c09d740a53f8399b121123b1a3a9ef03b018e9c9e485c0cde10c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:03.923Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 7057.897500000006, "promptTokens": 5228, "completionTokens": 1752 }, { "requestSha256": "881647ddb93ba9e84b77222a154866342c38bb7a885674bee52f11d9a17c7dd4", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:11.096Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6038.172707999998, "promptTokens": 1598, "completionTokens": 1220, "reasoningTokens": 1054 }, { "requestSha256": "9f4d2ae077f3e0d1ec62b8e0889d7d2f327fb248ea98aae3c80ee14116142c86", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:17.139Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 23250.824000000008, "promptTokens": 1547, "completionTokens": 4883, "reasoningTokens": 4687 }, { "requestSha256": "3577737e3cee7ac54c45cba60b9480d72c21610d03836c6f7fa72a8eee600326", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:40.476Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5902.455916999999, "promptTokens": 1670, "completionTokens": 1418, "reasoningTokens": 1221 }, { "requestSha256": "8402182ec863943643ecf7c2b0726588561e216e47133de0540d9cbcd0aaec8d", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:46.383Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3009.6352920000063, "promptTokens": 1623, "completionTokens": 476, "reasoningTokens": 289 }, { "requestSha256": "a0b66736729bb8573220097fcc01701ffc8be4409420c19d788c1b87380fe73d", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:29:49.399Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 10886.748959000004, "promptTokens": 1608, "completionTokens": 2215, "reasoningTokens": 1975 }, { "requestSha256": "17ee805f9114d0d442833dbd7a903ca0a2041ddc7422c98c330e91ad8c88dc6b", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:30:00.291Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5811.384874999989, "promptTokens": 1571, "completionTokens": 1214, "reasoningTokens": 1032 }, { "requestSha256": "734f3da5f37a39cb321d848e5966d27c53e203712c2c6aefb450429a280d8c8a", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:30:06.107Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5674.059374999997, "promptTokens": 1645, "completionTokens": 1087, "reasoningTokens": 900 }, { "requestSha256": "cafb97f881efaea1c37f2c84d5384926b9b241daa4d2534822b4481176c00982", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:30:11.982Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3195.8471249999857, "promptTokens": 3629, "completionTokens": 544 }, { "requestSha256": "92dab1d92fa629594c24e9e4a985c86e83dc5583d7d6588fd4de7d4f51604d7a", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:30:15.185Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 15733.682499999995, "promptTokens": 1735, "completionTokens": 3553, "reasoningTokens": 3368 }, { "requestSha256": "e989475941ad6cd27098aad73466fff0ed444727ca9141dac8b745478a20bace", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:30:30.923Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 1876.1325420000067, "promptTokens": 1535, "completionTokens": 247, "reasoningTokens": 79 } ], "diagnostics": { "BenchmarkTest00094": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00620": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 49, "endLine": 50 } ], "modelOnlyVerified": [ { "cwe": "CWE-22", "startLine": 49, "endLine": 50 } ], "servedCombined": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ] }, "BenchmarkTest00588": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ] }, "BenchmarkTest00641": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyMapped": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ], "modelOnlyVerified": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 }, { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ] }, "BenchmarkTest00780": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest01047": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyVerified": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "servedCombined": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ] }, "BenchmarkTest00152": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00497": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ], "modelOnlyVerified": [ { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ], "servedCombined": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ] }, "BenchmarkTest00660": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 58 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00898": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest01209": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 52, "endLine": 52 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00068": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest00292": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ] }, "BenchmarkTest00541": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "modelOnlyVerified": [ { "cwe": "CWE-611", "startLine": 48, "endLine": 48 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ] }, "BenchmarkTest00415": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00494": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ] }, "BenchmarkTest00943": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": null, "startLine": 55, "endLine": 55 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00844": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "BenchmarkTest00512": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 56, "endLine": 56 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00511": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ] }, "BenchmarkTest00452": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00841": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 49, "endLine": 51 } ], "modelOnlyVerified": [ { "cwe": "CWE-79", "startLine": 49, "endLine": 51 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] }, "BenchmarkTest00012": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00099": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ] }, "BenchmarkTest00991": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest01200": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 }, { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ] }, "BenchmarkTest00818": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ] }, "BenchmarkTest00161": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 } ], "modelOnlyVerified": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ] } }, "gatingStats": [ { "batch": 1, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } }, { "batch": 2, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } }, { "batch": 3, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } }, { "batch": 4, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } } ], "batching": { "maxFiles": 8, "provenance": "Frozen protocol batching metadata", "batches": [ { "index": 1, "caseIds": [ "BenchmarkTest01047", "BenchmarkTest00152", "BenchmarkTest00497", "BenchmarkTest00068", "BenchmarkTest00415", "BenchmarkTest00943", "BenchmarkTest00991", "BenchmarkTest00818" ] }, { "index": 2, "caseIds": [ "BenchmarkTest00780", "BenchmarkTest00898", "BenchmarkTest00292", "BenchmarkTest00494", "BenchmarkTest00844", "BenchmarkTest00512", "BenchmarkTest00511", "BenchmarkTest00012" ] }, { "index": 3, "caseIds": [ "BenchmarkTest00094", "BenchmarkTest00620", "BenchmarkTest00641", "BenchmarkTest00660", "BenchmarkTest01209", "BenchmarkTest00841", "BenchmarkTest00099", "BenchmarkTest01200" ] }, { "index": 4, "caseIds": [ "BenchmarkTest00588", "BenchmarkTest00541", "BenchmarkTest00452", "BenchmarkTest00161" ] } ] } }, "untouched": { "schemaVersion": 1, "protocolSha256": "8c4260d2f76e9a5eb092e2f24b5057473f81d198bb92827836706eecb4f11511", "frozenAt": "2026-10-22T09:27:49.052Z", "startedAt": "2026-10-22T09:31:02.351Z", "finishedAt": "2026-10-22T09:33:51.311Z", "suite": { "name": "OWASP BenchmarkPython v0.1 balanced 28-case model detection-stage pilot", "repository": "https://github.com/OWASP-Benchmark/BenchmarkPython", "revision": "f1291485808b66e20ddb6b01b10dc71b3df8c8ba", "labelsSha256": "6396f37c97cfd0c018db3d8750095ce6c678a083f83620cfb3e88fe27a46bb0c", "totalCases": 1230 }, "config": { "model": "deepseek-v4-flash", "baseUrl": "https://api.deepseek.com", "concurrency": 1, "timeoutMs": 240000, "reasoningEffort": "none", "chainReasoningEffort": "low" }, "runtime": { "bun": "1.3.11", "node": "v24.3.0", "platform": "darwin", "arch": "arm64" }, "sourceIdentities": [ { "path": "apps/scan-cli/package.json", "sha256": "cc9d0ae3f24a0f1a2858e9ff0663c4804b88c77f8e2b8cf8a8b1082dc0e3d024" }, { "path": "apps/scan-cli/src/analysis-cache.ts", "sha256": "d0baba6157b77cf5cba8f8f6ac59d7929442ca9f144081b3622af80fac1f147f" }, { "path": "apps/scan-cli/src/analysisCoverage.ts", "sha256": "e3e0ba94e08f15d16db22214b3169798241d27ace83e9c2b3339ac2fde0f8ae4" }, { "path": "apps/scan-cli/src/appmodel.ts", "sha256": "11cb10ad4dc07e45360addf350638c231942a34c8a94cb56dffd687d40658f9c" }, { "path": "apps/scan-cli/src/batching.ts", "sha256": "4dbac39c710e1a5a661807c31dd1710d28f4554b5fb300541282eb38deb6e7cd" }, { "path": "apps/scan-cli/src/bench.ts", "sha256": "59b7870fc1cccd5925260c4912bfcc33b279c4dfd655e69cde689b23f59f9d12" }, { "path": "apps/scan-cli/src/benchmark-scorecard.ts", "sha256": "025b9f1a2fa845985d9fafbb6e84e6a39557eb73eba6064fcc2486b9a45979ee" }, { "path": "apps/scan-cli/src/cassette.ts", "sha256": "a811a8a9037156049094648cddb02ea0fd28938e4d5d7f9ba7a5d520d8ddb1c2" }, { "path": "apps/scan-cli/src/context.ts", "sha256": "26e02925eb5f20405171950bb35d20aaf71aa67eade8482ea70e4c89ced0ac1e" }, { "path": "apps/scan-cli/src/coverage.ts", "sha256": "10c0366ba24dfeb8792f4e1b817293186c6f1b6471cc4d01b2dc4096abc9e910" }, { "path": "apps/scan-cli/src/coverageReport.ts", "sha256": "e8eed15e9df0baefcd94ace34fcf0e63119e87ac4bea3595c2a279a060687a19" }, { "path": "apps/scan-cli/src/deepdive.ts", "sha256": "49c5913019358f87477bc93cab3daaa391beb8ebc307b55637d8f1c9234d8de9" }, { "path": "apps/scan-cli/src/deepseek.ts", "sha256": "b922cbf013b81ed1c3d682ce6e67868a3526034efd011ca6eb78dfc7e1ad8543" }, { "path": "apps/scan-cli/src/defences.ts", "sha256": "fb11f03b658d149a5e74bd8a18c74f27dc74aa24152d301703a1126c5723478f" }, { "path": "apps/scan-cli/src/depGraph.ts", "sha256": "b2e354315743883ed58cdcb22b3e242267e27ad3745ae11903f5d93c278be1f0" }, { "path": "apps/scan-cli/src/dependency-observations.ts", "sha256": "d8c14d1d944f1870602d35ec2d2e5b297e161423a0ed242256c60927b922f02a" }, { "path": "apps/scan-cli/src/depth.ts", "sha256": "aa01dd09689eb2cd271473b3628438951bc367a848807989a552cbf2d54fe1aa" }, { "path": "apps/scan-cli/src/envNames.ts", "sha256": "97071edd26823ab361d481785c04066eedabe6a5866c425562f089b4c7cc2c69" }, { "path": "apps/scan-cli/src/finding-response.ts", "sha256": "645faff3e3e6f9bd1d7bb7a7f93dab6bdb3f28787f08a6b97670193b5af1dc4a" }, { "path": "apps/scan-cli/src/fingerprint.ts", "sha256": "058ef82e52a20e2207d5c356bf8780a4bb8c02e88873be4bc079539c77225306" }, { "path": "apps/scan-cli/src/gates.ts", "sha256": "cc1f057e50be79d3fd397994dfc1df202812f05cf117b0145716c9c86d02e377" }, { "path": "apps/scan-cli/src/gitleaks.ts", "sha256": "3b45e13abb74de4f204acb29c82b3c8a3c6628373fe91c590bd4ea377f9bec38" }, { "path": "apps/scan-cli/src/helpers.ts", "sha256": "ae9c19d7ff10118b3089d4709a04f0cc749083dfe23d3e0c865b692ac32cc4b6" }, { "path": "apps/scan-cli/src/iac.ts", "sha256": "78011b64b0c4da54861405f19b9e33fe9f5b42f5c2108330c9fe46f17fd033ed" }, { "path": "apps/scan-cli/src/image.ts", "sha256": "a7aa4b3605587ec02c07116058a720c7b894b34b000598010f67061bbc9e2e22" }, { "path": "apps/scan-cli/src/imports.ts", "sha256": "37e654e1643d66d1b4b3dd08a71f029c85221f24bc1857a52f4c289e536de42a" }, { "path": "apps/scan-cli/src/independent-benchmark.ts", "sha256": "44d2a86c3e10ea7b897800dec90f7e73fd7096bc575c4fbdac50308a4561f242" }, { "path": "apps/scan-cli/src/index.ts", "sha256": "28244b9a65713e5d5f4e5a5581de5302372e1a5436870f1543dc5936805fd632" }, { "path": "apps/scan-cli/src/intelligence.ts", "sha256": "93bfb294b41bdf1616533ac6445c271430497e0def81e6443ef723c6a35efc90" }, { "path": "apps/scan-cli/src/kernel.ts", "sha256": "18f2d1eeeeacc4b528e343c91cae0b08bc6e252427e886af5470730d8774d4f0" }, { "path": "apps/scan-cli/src/logger.ts", "sha256": "3d53733daa48af057f2709b29af2d0e506af3f62764ea64cd1b5758be0ba8582" }, { "path": "apps/scan-cli/src/manifests.ts", "sha256": "bb1672c1bd3c1d399c16878572874efbe5e648e33b88e61455ba98b574d04af7" }, { "path": "apps/scan-cli/src/mapFinding.ts", "sha256": "be3ec1f53d70c7f6021ad695ffc37363e46d2dd34b047c14ade59dce2401459a" }, { "path": "apps/scan-cli/src/model-benchmark.ts", "sha256": "d1807991cb04db49daadc70df165a2c25b90ab33409168fa2b3b4d4feaf2b9c5" }, { "path": "apps/scan-cli/src/noise.ts", "sha256": "5d30d0453a93bd04a4bc10be6692d8a9813677dee35c7c3ba7af12ee7fb16bfa" }, { "path": "apps/scan-cli/src/oci.ts", "sha256": "c5600f5dbeb7e786ebcf0a75cf1d24c35314af3fcdcdc681feac7ad1154f7277" }, { "path": "apps/scan-cli/src/openapi.ts", "sha256": "6223b8611795454a8f0f52ec1f7bb577f19b144d41cb19dd226dc6c7168328c9" }, { "path": "apps/scan-cli/src/osdb.ts", "sha256": "cd464bb11b5953068934c17cde3f10bedaeaaed03fdf6d85cf267a2df0145e6b" }, { "path": "apps/scan-cli/src/prefilter.ts", "sha256": "53571e87886dbc160b0d64cac8a485c84d539c34e2a67bc07262350c2b83176f" }, { "path": "apps/scan-cli/src/prompts.ts", "sha256": "db36528333685d0972db8aae400b88a4e965e51a9ab7e4802725fb2bb41d6948" }, { "path": "apps/scan-cli/src/pullRequest.ts", "sha256": "2fbfa5525a0a9e9e0f9f35348429f397cc37bf22a897f779ea83e31a3d7c31bd" }, { "path": "apps/scan-cli/src/python-config.ts", "sha256": "cbd69945e59780938e88bbd3ba594696ad7c4fcfe00550e4a07102bd685e4065" }, { "path": "apps/scan-cli/src/python-flow.ts", "sha256": "ffc6d7325bbfefcc33b295998ee00ca3fb6fcf3af5df6391afff60a59ac34ade" }, { "path": "apps/scan-cli/src/quality.ts", "sha256": "7b69ff447ff7d673420eb84fc13c19b8b3a779f18bc01feb3c5c44166bcce40e" }, { "path": "apps/scan-cli/src/reachGraph.ts", "sha256": "099e451f8b1cf41d631d2831dba4629e4bc7ea0c31ce6b1291571e4f602dbd04" }, { "path": "apps/scan-cli/src/reachability.ts", "sha256": "fa01a82a0bca1a3ba67faca4f6fdc209fc0b81f099b59f70ead33dc6a1d5c24a" }, { "path": "apps/scan-cli/src/recovery.ts", "sha256": "c51f097dc8f7dfa1f0576c9c66fc459acb615122ad9e9d78b7ecad124b6c7e98" }, { "path": "apps/scan-cli/src/relatedSpans.ts", "sha256": "b455844c8a2dd2c8a91e56a291920ed34c7a3fb003c6cb285a82f2c5a92aaf2e" }, { "path": "apps/scan-cli/src/repoSecrets.ts", "sha256": "071dd5a1b259aa2cbf7adcd32b5a6010c69a8601711ae5a3f74117df35611d0f" }, { "path": "apps/scan-cli/src/reporter.ts", "sha256": "7c1ee9071898d0c47eb79c6542c7bd677933eda9f159f0dea9fcdcafc28bcbd6" }, { "path": "apps/scan-cli/src/repository-benchmark.ts", "sha256": "dc324cf0bf446082626a6bd31879782a6516149bd45d9293d7dbc519d7f08cb4" }, { "path": "apps/scan-cli/src/rule-defenses.ts", "sha256": "02e15e50eeefe594378f0cf7e9925d651df06561e64fe06365c7bcfdb3dcf1a1" }, { "path": "apps/scan-cli/src/rules.ts", "sha256": "4cd142f29398311478e0931f6f2cc0646d03d8f7448c423751927773996e4889" }, { "path": "apps/scan-cli/src/sbom.ts", "sha256": "2f76a139d11e49b67a826603881cbf81ffc4474bc4bd9fde6506e0c558c8f0d9" }, { "path": "apps/scan-cli/src/scan.ts", "sha256": "df65338708a1de4edb042b1bd3fbec79455c3b61ffabb8fba0caeff2a594e9e8" }, { "path": "apps/scan-cli/src/scanVersions.ts", "sha256": "5e3991039c32835b23767c90aafaa33ab15a6e61f7e01a9b0d3ab5683c602653" }, { "path": "apps/scan-cli/src/search.ts", "sha256": "f9db1c3b5fe9900a6e4f4335d53ada9083e2ae932ebcee853b56f527ba95f219" }, { "path": "apps/scan-cli/src/silence.ts", "sha256": "8c65ac7f0df90c9c15394ac6de861f86ce3d89a2930a8ebe7445d63eaa5e2787" }, { "path": "apps/scan-cli/src/spread.ts", "sha256": "2d80502b0d1b0d453aa0e2da7513fefdf75755a37d5af1e3cf6a5cb08b12d9d0" }, { "path": "apps/scan-cli/src/stability.ts", "sha256": "61012aae5957361f46a8f15413ea429e7350fefabce4e9e0e6fa972278cc34e7" }, { "path": "apps/scan-cli/src/stop.ts", "sha256": "d35e4491a63e6792342b8b5deea342a2b4bbe22975aeb6f26c51537e2275fd6f" }, { "path": "apps/scan-cli/src/sweep.ts", "sha256": "1c51efc21e15e6fa3bbf1b5d3b7504e7aed497a507abe5182397c1250252ce55" }, { "path": "apps/scan-cli/src/tar.ts", "sha256": "2c80b52c78e9c75185ed90b3cd4f4a6bca969fe0d1c736f15f8b72e47773e6f6" }, { "path": "apps/scan-cli/src/template-flow.ts", "sha256": "435188aca557af792af85cb0553cac1361e075e2d3e007f8963b2e399810469b" }, { "path": "apps/scan-cli/src/tools.ts", "sha256": "cf9de13aa44e1550fdeedfba7e25ac7ccf36b289825a8eaf3f1928cf8b5df3d8" }, { "path": "apps/scan-cli/src/trivy.ts", "sha256": "150153c1b23996bc0f8a32301c65d0bff0be1fa2fae6cb7eb0f5c581c700c236" }, { "path": "apps/scan-cli/src/verdict-contract.ts", "sha256": "e24ab43d9f4cc96ebd2e3948286779b2e0b0390f42106f14b3b7eef3bcee9d61" }, { "path": "apps/scan-cli/src/verify.ts", "sha256": "a107310a1f21fff33e0642c492bd368858c4c46da73dedebfdf480f4931b8bfe" }, { "path": "apps/scan-cli/src/walk.ts", "sha256": "3d2a350dfe6e25403e50eefa3a0dbaebe275b422950717fc438be3bd5c74d097" }, { "path": "bun.lock", "sha256": "14b55bb0ae964bab83edb70d146e5e5eac16a7ef7418b4bd94842a5335edbbbd" }, { "path": "package.json", "sha256": "0c61121892bbd320487234c977f0e12f550a611adcb621d86d138c60cf0f6422" }, { "path": "packages/schemas/package.json", "sha256": "a46ecb31aa9aa33ceb6daafae8394ccdfa228fc7789198c421a02c0999aaa786" }, { "path": "packages/schemas/src/billing.ts", "sha256": "7ae419533da6bc2a20ad243b33b452dcd25d7dd67fe6c4b89c7d44193818322e" }, { "path": "packages/schemas/src/careers.ts", "sha256": "c367f27b05dfdc9d57e25fe9987bf21e78f3f65ea9556afccea999cbfc068c46" }, { "path": "packages/schemas/src/dependencyObservations.ts", "sha256": "d5a641b059b22592c692d3283502b9d77213ec42e77e03e600d0a20ee72d4038" }, { "path": "packages/schemas/src/findings.ts", "sha256": "a12c3448f1e41d2eda5313f9b9a8fcf64ed2b77ebc80e5e22a7c682060878a38" }, { "path": "packages/schemas/src/immunity.ts", "sha256": "cbe2557cc42d164e9d677f92ab8e26ce12762b4b2f60d5a3f2430b59a793abce" }, { "path": "packages/schemas/src/index.ts", "sha256": "dc8572d1089083d76301bdf8634bfe9565973f00e6cc49beca1101df17ec4cbe" }, { "path": "packages/schemas/src/investigation.ts", "sha256": "0a4a6a4370ff428910b2fb0ef53450fae064392dc58e341f8eb33da2252300b5" }, { "path": "packages/schemas/src/ir.ts", "sha256": "c1b1d0766b20e4830a9a6ab35d27ba16dc676f9a4c2a9badebd4fdbd17919df8" }, { "path": "packages/schemas/src/knowledge.ts", "sha256": "74488c0199366e71df6c2a83e71333317392e6b010e88f6beb66b935cec4bc85" }, { "path": "packages/schemas/src/notifications.ts", "sha256": "994d00573e810665c4379c2cb86147d28ac588ffca1b7f5c305cbd3ee98578c9" }, { "path": "packages/schemas/src/packages.ts", "sha256": "cabe240416e6c35be7baae9e776017e272f03efc5c4bcac3db05b3c11fa75d7e" }, { "path": "packages/schemas/src/proof.ts", "sha256": "80dcb156960b75ec0dee7e607fba08229ddc0cccb5c8951e813274b27340953f" }, { "path": "packages/schemas/src/reachability.ts", "sha256": "6f78887ccf9f09df85e9cad8b5c271fd036782846bcdd301de44e85645f86b39" }, { "path": "packages/schemas/src/reproduction.ts", "sha256": "ef08346d379d5f325bd579a7536679fef7d09fab7f4925392c55c55fd3aa7ab5" }, { "path": "packages/schemas/src/scanCompletion.ts", "sha256": "881dd9263b32be386c364e8595562cadf7e9cbda9efe5aa64abac11b798c7e8f" }, { "path": "packages/schemas/src/scanPullRequest.ts", "sha256": "09e56c5771b087884f735f69a3f3cb625f99e7aab1a867fd1f469fd1906ba2b6" }, { "path": "packages/schemas/src/scanReasons.ts", "sha256": "fba539e6d3c2140db2a329a6be9ce53e7ed0f6dc4437f085d2ce014be71d200a" }, { "path": "packages/schemas/src/secretRepair.ts", "sha256": "f139123f488ba9a19e2a22bcd02544986d0e056358876a3db51655f7d5a99be2" }, { "path": "packages/schemas/src/secrets.ts", "sha256": "e3a898bcadcbc68d0587b513db1d1945174437f358e0fe33624e97df50b42c00" }, { "path": "packages/schemas/src/security.ts", "sha256": "311afcee8ce9a869a622a19e2b1db1e57e003ace1f655921760ec21689a46f44" }, { "path": "packages/schemas/src/states.ts", "sha256": "540c39ae578d9f7cae4ab84e5e183852e6eb84ae49d1d992c2cbf8c2e81a66b6" }, { "path": "packages/schemas/src/wire.ts", "sha256": "b0c21292deadef07a17133b79eb89e4d3dc3dd6bfd165f61653efb699d9d6c3d" }, { "path": "packages/schemas/src/workspace.ts", "sha256": "17a5fab2b0f41f698fbe2f1eceb055c035ae04bec35f547c03531d2e0eefbf42" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/rule.yaml", "sha256": "add1d0987ffcb76cf8286d4da2210674893a8a8c693c9afacb5f4adbbfc7f73d" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/safe/sanitized_html.ts", "sha256": "0d602cd9ae708c8060652de16f1c361a5522dc81d81624e8bdaaaae2664457d2" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/vulnerable/bypass_trust_html.ts", "sha256": "dda816ef1b3d98aa23f109516466c901b66bee2cc3c4742f997ddbf75dac2165" }, { "path": "rulepacks/common/CLEARTEXT-001/rule.yaml", "sha256": "19d83cbe5fabd840248811236a6426d860695cc99d57105d7f67d71b46cfb809" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/safe/https_endpoint.ts", "sha256": "c497ad77c81fd53d387c2b5b10161388c87628740d0b678891581d330ab1ca03" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/vulnerable/ftp_endpoint.ts", "sha256": "c3a6c3a828cc4cdca45bbdf486c6c2856066163884baa74f760a91e896f11870" }, { "path": "rulepacks/common/CMDI-001/rule.yaml", "sha256": "76a524d4596595bec3d2b8550e593f8f73b2c463c594bb7a70f2cb8c3ea9346c" }, { "path": "rulepacks/common/CODE-001/rule.yaml", "sha256": "313aa196ab864dd25536b018605c1c3b36f18956a367376ee0e005bb319f58be" }, { "path": "rulepacks/common/CODE-001/tests/safe/comment_mentions_eval.ts", "sha256": "a47f8173953238cb60d08856a1b037366fbe536a88da34b23c643e9cad35d572" }, { "path": "rulepacks/common/CODE-001/tests/safe/literal_mentions_eval.ts", "sha256": "3d09dab28d07ba35d263943091655822f5f5d217b2d6fccbbf3f9cb435bacfc2" }, { "path": "rulepacks/common/CODE-001/tests/vulnerable/eval_query.ts", "sha256": "e3f4f0d3c518040aa2696ea7f76ff19db67601d38be08b42373615b3ded3dae0" }, { "path": "rulepacks/common/DESER-001/rule.yaml", "sha256": "20b2f7b0d2b0a0dbf7d8725589a031e8d7cb58d318d151d099bfc1c2e484dd79" }, { "path": "rulepacks/common/DESER-001/tests/safe/yaml_safe_load.ts", "sha256": "7aaaf0beb687fdadfafbc7d6d1a952647353a222571032ea59242f87bf33dba9" }, { "path": "rulepacks/common/DESER-001/tests/vulnerable/yaml_load_body.ts", "sha256": "f108c65e1710a394fa1785691e1cb6d621e3e0b778da96403788137e3156453a" }, { "path": "rulepacks/common/PATH-001/rule.yaml", "sha256": "b45b1cfe6d8c5af96ec1e8a1c837feeb8ddc239424adca3c188a64c161a00d2f" }, { "path": "rulepacks/common/PATH-001/tests/safe/read_normalized_path.ts", "sha256": "de57b93ba7c7f086a1a9de7d2872628ccb63d84da3fb2fa1ef195bf58b0d2ca6" }, { "path": "rulepacks/common/PATH-001/tests/safe/template_allowlisted.ts", "sha256": "d1d539bba782f1be978bfc1758690d38426278adaf1a44dbf76705e47ce6618b" }, { "path": "rulepacks/common/PATH-001/tests/vulnerable/read_user_path.ts", "sha256": "f1b1f2b69e5992f4004d8a30d0e696fb19d21cd1cb02927e61687e5991d7569d" }, { "path": "rulepacks/common/REDIR-001/rule.yaml", "sha256": "ebaba25880fec0039dad28bd24cbdd36541ab08036ce72527d31363ba37551f7" }, { "path": "rulepacks/common/REDIR-001/tests/safe/redirect_allowlist.ts", "sha256": "903c9879c7b4b35624849633a17e8a34a86dc25f4526cc3df5342b5bb0e49bde" }, { "path": "rulepacks/common/REDIR-001/tests/vulnerable/open_redirect.ts", "sha256": "efd4e225c944fb8647054fa952e40f0d6f3b3b905e22a6bf89f4b2c310daf363" }, { "path": "rulepacks/common/SQLI-001/rule.yaml", "sha256": "3e64945a2e853ae7bbd868a110edbca234966a170a03f3dfe6f49de7077c6fcc" }, { "path": "rulepacks/common/SQLI-001/tests/safe/drizzle_where.ts", "sha256": "106f09d70c246f993c7098b5d059bea9b836d1d025154d2c21b2b330519e7ceb" }, { "path": "rulepacks/common/SQLI-001/tests/safe/identifier_allowlist.ts", "sha256": "bca1e858b9fda6aff77dc1334c96e61446966250ab503c5832c0ef2919ce8436" }, { "path": "rulepacks/common/SQLI-001/tests/safe/parameterized_query.ts", "sha256": "bc711ba097116beaedf72e93c7b3b20b961a2d1258948ecb0dbe6e0ab8831a4c" }, { "path": "rulepacks/common/SQLI-001/tests/vulnerable/concat_query.ts", "sha256": "a2429d8b1f611d41495a356ac305368dc5b78092e491a43bedf6a0f663b6ecb8" }, { "path": "rulepacks/common/SSRF-001/rule.yaml", "sha256": "86bbbbd1f8bfe819cb8af8bde8ca5e43e038979c728fa8ad030641777a631f3e" }, { "path": "rulepacks/common/SSRF-001/tests/safe/express_proxy_allowlist.ts", "sha256": "571f26fc750cdb14b72c7803cd2dd50d62acd806d1677dd5165aa92060ecd21f" }, { "path": "rulepacks/common/SSRF-001/tests/vulnerable/express_proxy.ts", "sha256": "e4f646374bcb08c30fb8af627a91668f4841512cebe1bf804f79c0c4cc2229ab" }, { "path": "rulepacks/common/SSTI-001/rule.yaml", "sha256": "1cf2a5878dad69f9adf9cad88ea2000064898a51447e053a47ef05581954edde" }, { "path": "rulepacks/common/SSTI-001/tests/safe/precompiled_template.ts", "sha256": "0d5febf5ff8f2070115eaeba0870cdfcd392a2dd142487f0a996b04cc491a6e1" }, { "path": "rulepacks/common/SSTI-001/tests/vulnerable/handlebars_compile.ts", "sha256": "4b04998aa32236b06404c7c9aaf2674d01173576b2401efd4904166a4f30fd5f" }, { "path": "rulepacks/common/UPLOAD-001/rule.yaml", "sha256": "e5d8812fab296e63bb94fed6486797995e830fd2feedb5e4ac567bb7e904600b" }, { "path": "rulepacks/common/UPLOAD-001/tests/safe/mime_checked_upload.ts", "sha256": "e020db518e233ac8433f5237c1744d70d6854bd802dbd232f6377d1e03c9aa77" }, { "path": "rulepacks/common/UPLOAD-001/tests/vulnerable/unchecked_upload.ts", "sha256": "c2c4629e3af2db831f72d99572b49c758174bb224e4a2f4abb88ab82f12a3967" }, { "path": "rulepacks/common/XSS-001/rule.yaml", "sha256": "4eafa1e0a5329f76ec075e03d6bf756570cd1643ec4b1aaff9f4ae8960073237" }, { "path": "rulepacks/common/XSS-001/tests/safe/escaped_html.ts", "sha256": "199162c065905fc36a12bae5eedef52093de52b6faea7189b26c94fc4b297fd0" }, { "path": "rulepacks/common/XSS-001/tests/vulnerable/inner_html.ts", "sha256": "9bc3e7f70495dec60e4fae6e44c6525d1f7eed9eaab34f1b7f0c2f62ee334865" }, { "path": "rulepacks/javascript/CMDI-002/rule.yaml", "sha256": "ec140652bbbf75b9ac7abf0491617a7b2fedafec6b01e061afcc455fd46dfab2" }, { "path": "rulepacks/javascript/CODE-002/rule.yaml", "sha256": "5fba2995a7c08491b7fce10659cff11e00d9197bf59a5d3a38f93403ca398b63" }, { "path": "rulepacks/javascript/PATH-002/rule.yaml", "sha256": "6cd1dcc2bd021b507e56eda1048e2d556a7f2d63e174a387c55654dfd32b2fc1" }, { "path": "rulepacks/javascript/PROTO-001/rule.yaml", "sha256": "bf376e71fc05a878df13da0e52dad459fb0c3fd64022d8a69733f3714f6c0ee7" }, { "path": "rulepacks/javascript/PROTO-002/rule.yaml", "sha256": "a33eb6189979feb4815736b9b41878181409cb6582bcbc84cf8b570a8ca6fdde" }, { "path": "rulepacks/javascript/REDOS-001/rule.yaml", "sha256": "b20709f91bfe5bc2b834174a53fb2d0aa2772fd21838191273c117a662d7fbbc" }, { "path": "rulepacks/javascript/REDOS-002/rule.yaml", "sha256": "96c5b0ca1b87ccfd62d47a5cdf0333b9aeb8af676e57db2cb1bf51071a01f128" }, { "path": "rulepacks/javascript/REDOS-003/rule.yaml", "sha256": "1cc53d782185aed8c25f674342c6e25c26bf4fe7d28c11149cd7d4e6c00591b1" }, { "path": "rulepacks/javascript/REDOS-004/rule.yaml", "sha256": "4fc5fa489991681c7b6c7c8fdab2271f0e482c5bdf65cbdb1a5ed14fcc79fefa" }, { "path": "rulepacks/javascript/XSS-002/rule.yaml", "sha256": "265b5dddc5503e3cfede82589a20346e7111aee234aae699bd72010284ab4819" }, { "path": "rulepacks/python/COOKIE-001/rule.yaml", "sha256": "e96b7b90b587fa6d110a094a04a62e892ea7c3e568dc3348cb91152dc31b28eb" }, { "path": "rulepacks/python/DESER-002/rule.yaml", "sha256": "a77cd0730f50c608ddaa4d8446adb7b728522990b1cd772a96648113e522c731" }, { "path": "rulepacks/python/HASH-001/rule.yaml", "sha256": "e73bc710813e3432d33ebd5c3009af465ff431828a6f62023f8134284cb2952c" }, { "path": "rulepacks/python/LDAP-001/rule.yaml", "sha256": "ba5af874b16aced31442688c2696bdce5d653e06777cb8405ba4827fe81299d9" }, { "path": "rulepacks/python/PYEXEC-001/rule.yaml", "sha256": "e894bf53024edc28c99465d76e0ba6cf0041a365c3e47d886f8fa2d4bb9d978f" }, { "path": "rulepacks/python/RANDOM-001/rule.yaml", "sha256": "cc5ef82221e457cd3735ddf1a2460f0ad1b4c0a42d8d046dc6eb8826c8a4401e" }, { "path": "rulepacks/python/SQLI-002/rule.yaml", "sha256": "8870d9e0c8e50ef1e98bdd0a5d340a993fd08bb79c99b83ab0d5d428532efd3c" }, { "path": "rulepacks/python/SSTI-002/rule.yaml", "sha256": "9eaef2a4dd0a2a05427b38d57224363493ae4d6084de444cb972abe363b4a7e5" }, { "path": "rulepacks/python/TRUST-001/rule.yaml", "sha256": "951696eaf7ece7422b37a1fa86d5985f8d3b128d583ce50df98520a877896372" }, { "path": "rulepacks/python/XPATH-001/rule.yaml", "sha256": "17604e33d66d6d7e378932a5979beba8bd09166a0c9bb9fe298cd448ba34d43b" }, { "path": "rulepacks/python/XXE-001/rule.yaml", "sha256": "560eadedab50b15f003f19895559b947ef17958200940ab1099a351b3278bc4d" } ], "selection": { "seed": "cefense-model-followup-cap8-fresh-2026-10-22:", "procedure": "Exclude all 28 original model-pilot IDs and all 28 prompt-eight trial-cohort IDs. Partition the remaining author-labelled cases by exact expected CWE and vulnerable boolean. Select minimum SHA-256(seed + original case ID) in each of 28 strata. No detector/model predictions used for selection or anchor review. A publication evaluator inspected selected source before any cap-eight prediction. Selected source was not supplied to prompt implementers. Public labels and the deterministic corpus were already used in development; this is a fresh model-evaluation cohort, not an independent repository holdout.", "selectedCases": 28, "corpusCases": 1230, "unselectedCases": 1202, "caseManifestSha256": "058cce4c9e04c745cc05a528d4717c571c4187a6c67ca8cc969eedc37f8efb77", "caseIds": [ "BenchmarkTest01007", "BenchmarkTest00615", "BenchmarkTest00350", "BenchmarkTest00167", "BenchmarkTest01015", "BenchmarkTest00451", "BenchmarkTest00287", "BenchmarkTest00284", "BenchmarkTest00348", "BenchmarkTest00427", "BenchmarkTest00600", "BenchmarkTest00160", "BenchmarkTest00798", "BenchmarkTest00586", "BenchmarkTest00694", "BenchmarkTest00626", "BenchmarkTest01162", "BenchmarkTest00338", "BenchmarkTest00609", "BenchmarkTest00270", "BenchmarkTest00419", "BenchmarkTest00655", "BenchmarkTest00291", "BenchmarkTest00931", "BenchmarkTest00813", "BenchmarkTest00981", "BenchmarkTest01117", "BenchmarkTest00217" ], "sinkReview": "Read all 28 selected post handlers before cap-eight inference. Fixed operation anchors identify filesystem access, command execution, returned HTML assembly/return, SQL/LDAP/XPath execution, eval/exec, digest creation, security randomness, session mutation, deserialization, redirect, XML parser configuration/parse, or cookie configuration. Author labels are retained without adjudication. No score-dependent edits are permitted." }, "plan": { "mode": "default", "maxRounds": 1, "sweepEffort": "none", "verifyEffort": "low", "verifyEnabled": true, "minConfidence": 0.4, "absenceLane": true, "spread": false, "secondOpinion": false, "verifyEngineFindings": false }, "limits": { "requests": 80, "tokens": 600000, "dollars": 0.42 }, "scope": "Production detection-stage prompt, snippet mapping gates, configured verification and native union policy. Selected source files only, with imported helper bodies absent. No intelligence retrieval, repository execution, additional sweep/absence/spread/chain lanes, PR generation or full hosted scan. Public label-known corpus, not independent held-out accuracy. Labels and suite identifiers are not model messages. Native findings are never deleted by model review.", "targetPlatform": "unknown", "prices": { "inputUsdPerMillion": 0.3, "outputUsdPerMillion": 1.2, "source": "https://api-docs.deepseek.com/quick_start/pricing/", "checkedAt": "2026-10-22T09:27:49.020Z" }, "planned": 28, "corpusCases": 1230, "unselectedCases": 1202, "scores": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 1, "tn": 13, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 12, "fn": 2, "fp": 4, "tn": 10, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 11, "fn": 3, "fp": 1, "tn": 13, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 } }, "cases": [ { "id": "BenchmarkTest01007", "path": "testcode/BenchmarkTest01007.py", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "67971f1915cd821211affd63b8b36456445315fd734fcb359de5e53a45147810", "sanitizedSha256": "fc7a3d62dbf4bf7326bf5fa50c816f6c54f137d988101906cf236441a0dbfc10", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00615", "path": "testcode/BenchmarkTest00615.py", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 53 ], "sourceSha256": "52bebc0f9d08db292cc850e7836682a1fda68664f7af114e25c00d923c222448", "sanitizedSha256": "8d8134438c9d63cacf2ac39ef76e7623b1150c8b49642e5985b41a1fa9dcec43", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00350", "path": "testcode/BenchmarkTest00350.py", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 58 ], "sourceSha256": "52eeea7199c73ff35fdb3e260ed647337df16f962f40a7e5b2e2854eed3c6476", "sanitizedSha256": "8076ecec596358fd7bfa58c482282ac1894f50c345aa8d373a31288a94d70ee1", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00167", "path": "testcode/BenchmarkTest00167.py", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 53 ], "sourceSha256": "9ccadb894c12ca6ad016aee03830140737f3872c8c3d7bd520814316724a4fd6", "sanitizedSha256": "382a56470a48846110a7a770dfddc73de0891c278a1013d419e560d75d13a54d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest01015", "path": "testcode/BenchmarkTest01015.py", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 42, 43, 44, 46 ], "sourceSha256": "6fe8f9a6edc8199cf617ea6a09967aa5e684a206a70fb06c76b17924812e8ad6", "sanitizedSha256": "79b7af09fcbeae91b4f5e388975a3ba9913ebe3008c53f80301c08db4ff33592", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00451", "path": "testcode/BenchmarkTest00451.py", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 43, 44, 45, 47 ], "sourceSha256": "3126d8fb33f6bade6bea694afa71da086701a1bf867dee1fbfa0932746e89883", "sanitizedSha256": "23e9100bb6ba525eca147e074568a4e229744546abd431efc2033e048f1ddc76", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00287", "path": "testcode/BenchmarkTest00287.py", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 56 ], "sourceSha256": "1b9c652c64ed5ff27094d50029745be8262c4f1bb6d1eb464021155ae11581d6", "sanitizedSha256": "d3f378fae1f062199e039a12b6e2e7f2a94417539137982dcea706bdbe079c16", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00284", "path": "testcode/BenchmarkTest00284.py", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 47 ], "sourceSha256": "04c951a90cf18546dc9d73adaf38c77a89c4a5feb4dc735ad86e94da26ffccf6", "sanitizedSha256": "9e26fde3d05ea48b1279b5a7e7edd738d7dd5fcb59df6468cc28a8d3b06754d4", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00348", "path": "testcode/BenchmarkTest00348.py", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "5546e77472ad706eb5065e782b66cec9b12c9d14c96751607aec6c53ebc9e528", "sanitizedSha256": "427703f1a9a6fc17b4a08a5c815863bb44a5e3dd64095f7891412260db963037", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00427", "path": "testcode/BenchmarkTest00427.py", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "60ec9393dc85e226115ef6acb592647c073598ddbdb6e6e94860af5ced291eb8", "sanitizedSha256": "2b36af950f27f3ccfc73959ba01e8c8b3b7a6144d02c3da40e98c496839ff599", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00600", "path": "testcode/BenchmarkTest00600.py", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 52 ], "sourceSha256": "1252055c6d5eb366d70c6f17f50d3db4e5c614374d6eedb2be55e9d6801ee8d4", "sanitizedSha256": "a1e31708d611b9f3be8f84a0f2185c28aa29302101febbdd0f855b3e8ff473a6", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00160", "path": "testcode/BenchmarkTest00160.py", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "a0a5b629d6c62d373f5adedccab68738844d97a4c6f696603fda0b93c096bad0", "sanitizedSha256": "56b8d2a1682510bd0304b34e3a3dfa61064e1a17c3098f3a51cf4f46b4c85563", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00798", "path": "testcode/BenchmarkTest00798.py", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 59, 60 ], "sourceSha256": "ca7d8e4a42b1caffa0afacae04aa881cec9440c38956033a8b4f76bbd1259aa8", "sanitizedSha256": "ea2d5466e223109ce5275abe077ae0d9533fdfb293a8565cc3972efcb80cc43d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00586", "path": "testcode/BenchmarkTest00586.py", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 59, 60 ], "sourceSha256": "fb2bbc1d572e6c8566b87e2f336af60b0c68f60026d3889532ca8b7376ab8926", "sanitizedSha256": "d6501743620d4b6928d88e88820effd2163968c254e7fdec9739417a79df5c7b", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00694", "path": "testcode/BenchmarkTest00694.py", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 46 ], "sourceSha256": "b7a1d4a7140383340673cc9cd8a8453f8e9e7db0a49be799ae1bfb9daa294659", "sanitizedSha256": "3ef9779038e71b6669bdaada6db39a63a1cd923b8e44e610d6386d20da4ca87f", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00626", "path": "testcode/BenchmarkTest00626.py", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 52 ], "sourceSha256": "f649713f591b955b3972101bb9addaffa902389d9a58e3a9fac126c8e5a67bad", "sanitizedSha256": "0015d582a1ae9bf08a61337dceb56cca3aae5fe1d94973d9c745d4b5cabe4382", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest01162", "path": "testcode/BenchmarkTest01162.py", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 39 ], "sourceSha256": "8a2bdb74a500ef829454abe8ed8d3189fde084121f44f7bced0c1c57e352d920", "sanitizedSha256": "0166fbad52e18a77640a4e97567a578935ec2104e4898dde87fa176c59e8064d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00338", "path": "testcode/BenchmarkTest00338.py", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "e32e47738921d7cec592d0799e74ba5bc9ae341be0d7b77fe39703d3c7e2a329", "sanitizedSha256": "4b69b99fb2edea089031cd8d105d864fc63e22d45127a2a500ec6092dab33124", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00609", "path": "testcode/BenchmarkTest00609.py", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 49 ], "sourceSha256": "83cf5531d3f0052cf422a5c8434b4f9f8cffee3899991a44c2c148f208406b60", "sanitizedSha256": "d68b04bb14e33328890ed119e876f99327e5fa48b387255805063594d727675c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00270", "path": "testcode/BenchmarkTest00270.py", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 41 ], "sourceSha256": "5dc0afd9732e8f154d5a20b72b1a5962d9db45df07bba03790c4f5f99f36f96c", "sanitizedSha256": "c4df13072f07e36898c7328de9fd356dd70d4b5aa3e94bfa8c6c04ebcc110a3a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00419", "path": "testcode/BenchmarkTest00419.py", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 62 ], "sourceSha256": "835ec5dfe16700aea9e8f18574c79424c688d04d91f4e2884895add188ac1130", "sanitizedSha256": "9676f1b20e2748538dd33815679e530147b7d17906126c01dd9ee4155acdeb5f", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00655", "path": "testcode/BenchmarkTest00655.py", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "c4430a1fdfaf5021260176a5af512c1f072256202e617dda9bd1e86154022e7d", "sanitizedSha256": "2ce8dfe9f42df52b021992824c1b63a95c92674e8fea648e5000fd6a464e6421", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00291", "path": "testcode/BenchmarkTest00291.py", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 51, 54 ], "sourceSha256": "65d36fbc3ea2769fbb9c826c773f80240f54ce48aef13ece68f8ceb39ce2dd64", "sanitizedSha256": "709f627942705848bb6f0c6009cc9a4791556b7af6845c385819bd236b8cb8f5", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00931", "path": "testcode/BenchmarkTest00931.py", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 63, 65 ], "sourceSha256": "937290bb758786591fe3df1e6826d3198a2978ca0f11fac9d2b24923e81978ac", "sanitizedSha256": "6893cb8c1e969e70c94fa9d3d8c7eb749e77d668f3631d3c2bc8852cad3fddf7", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00813", "path": "testcode/BenchmarkTest00813.py", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 58, 59, 60, 61 ], "sourceSha256": "d454674ec4cc6d2a239d699b0de6838f0e4947c652e6ed68c72b6b49f01cbf53", "sanitizedSha256": "2331977f110ee31e65ebc6d6a1f1bd7353bd2b561aadb20873348c5d058e9fe3", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 2 } } }, { "id": "BenchmarkTest00981", "path": "testcode/BenchmarkTest00981.py", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 71, 72, 73, 74 ], "sourceSha256": "e7c8025753d04eb1eb0b114b638cf35d1bee7bb8a6581d138274d2faac8be9a6", "sanitizedSha256": "388b74779120f182ac0764cceba2a79a3c752dab40bc415e69e2a7b51d560308", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest01117", "path": "testcode/BenchmarkTest01117.py", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 49 ], "sourceSha256": "e00710191997d6ddd81a90588de720e59ccd41f29dd19dff399cac97b1353897", "sanitizedSha256": "317923b905fc4a65d910a2b4053470f186f18c1d85e5e1256cf3b5fcc365045a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00217", "path": "testcode/BenchmarkTest00217.py", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 58 ], "sourceSha256": "c29d179625863390b237b59e47de0021a6db1aaa27d0c2fcce36b3e4060969bb", "sanitizedSha256": "42f095ee017bd40cdf81bf13ff16604408c717802d433a72e48c2abdbb65f0aa", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } } ], "servedCombinedPolicy": "Native deterministic findings are preserved and unioned with production-verified model findings using filterNovel. Model failures do not remove native positives and are not scored as safe negatives.", "usage": { "requests": 24, "tokens": 86758, "dollars": 0.05610719999999999, "costUsdUpperBound": 0.05610719999999999, "measuredPromptTokens": 53336, "measuredCompletionTokens": 33422, "unknownUsageRequests": 0, "latencyMs": 168610.27007899998, "accountingPolicy": "Configured peak cache-miss input and output upper bounds. Completion tokens include provider thinking tokens; cached-input discounts are not credited. Missing usage or interrupted attempts retain full reservation. Actual account billing is not independently verified." }, "providerModels": [ "deepseek-flash" ], "requests": [ { "requestSha256": "39ec07b6190fe8bb46df031b37cbb4a16fac0029cf3b2c86b26868d1e152e005", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:31:02.564Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5666.3005, "promptTokens": 5760, "completionTokens": 1177 }, { "requestSha256": "dd0f04311fb23072eddc5199c4a2564fa2fa9f6e0f6a1ada0b8dfbb10fc15409", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:31:08.239Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 4832.644375, "promptTokens": 1764, "completionTokens": 836, "reasoningTokens": 652 }, { "requestSha256": "4e1ed160ba2785a2c17d4d315b30c03a18b72765e0af185dbb5ac64397af7513", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:31:13.075Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 20013.244625, "promptTokens": 1660, "completionTokens": 3466, "reasoningTokens": 3347 }, { "requestSha256": "ad232a74eab033ab5988244ece72c747614379ad474918c5e9141439308e86f8", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:31:33.092Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 28215.379875, "promptTokens": 1911, "completionTokens": 6529, "reasoningTokens": 6282 }, { "requestSha256": "3d3922b7432f7da285ba7c1d5c5feb5b4c4630ecb46807c65fcfd19ee2582457", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:01.312Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3393.441332999995, "promptTokens": 1709, "completionTokens": 595, "reasoningTokens": 415 }, { "requestSha256": "018a9d6411fe96eea2ffb42e4b56532bfa79131fefbd3501699b066eabb45064", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:04.709Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2955.860832999999, "promptTokens": 1571, "completionTokens": 565, "reasoningTokens": 375 }, { "requestSha256": "598f21ee63fb82d548db1afaf60bc75001b0ba93f3635d7e6d02af49ea20a68a", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:07.673Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6382.689874999996, "promptTokens": 5658, "completionTokens": 1554 }, { "requestSha256": "74d5370b3668da569d9f3e7ccdc0086495f0a1f4b49b1c1e330e44b31b0f4de6", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:14.059Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2202.6272910000116, "promptTokens": 1792, "completionTokens": 253, "reasoningTokens": 91 }, { "requestSha256": "c26e44cb9b48119fc19244ac44de09cf9cc725e28c88a30e048ab6c3ce0456be", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:16.272Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3368.591790999999, "promptTokens": 1516, "completionTokens": 557, "reasoningTokens": 424 }, { "requestSha256": "cc74b8cd463965336eab98ba0df195cc77ec6bc225c6f2d791a7095ea1748003", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:19.645Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2171.5264159999933, "promptTokens": 1630, "completionTokens": 315, "reasoningTokens": 139 }, { "requestSha256": "4857a3d1b217dbdcfdfc2b7ebecf56bdcf691183ff373e77d8258ebc6dd30acb", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:21.821Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2428.2049169999955, "promptTokens": 1566, "completionTokens": 302, "reasoningTokens": 136 }, { "requestSha256": "f924d931bdf7eacf97637cd2af6d6a6043d005b2dd351a5c202caf300c38180d", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:24.254Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2645.431375, "promptTokens": 1763, "completionTokens": 456, "reasoningTokens": 282 }, { "requestSha256": "73cce775e84bb258fff0e854e479e0f874a64e5cf62b5ef7fca569bf005dd7f8", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:26.903Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 7026.589624999993, "promptTokens": 1765, "completionTokens": 1613, "reasoningTokens": 1461 }, { "requestSha256": "3d55b3375b38ea1cf5a869f4d7623a1475cd91a88b8c7d71e3110a686fa0a6e6", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:33.937Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6174.621957999989, "promptTokens": 5369, "completionTokens": 1391 }, { "requestSha256": "d16749ce217cb6a56a814161914d5a0748673320317766d74e8a46b10c35677b", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:40.116Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5857.4486250000045, "promptTokens": 1740, "completionTokens": 1389, "reasoningTokens": 1196 }, { "requestSha256": "513065503d544b05473b108c9731298404e2b429ddb282dc423596a444e2206b", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:45.977Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 12536.406583000004, "promptTokens": 1691, "completionTokens": 2504, "reasoningTokens": 2267 }, { "requestSha256": "f53baa55716bdc2c1859b4afd0710ba0232ee7971ea62da9558206534d289b9b", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:32:58.519Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6373.079332999987, "promptTokens": 1493, "completionTokens": 1246, "reasoningTokens": 1065 }, { "requestSha256": "a46a0c0bebcc6a04df7f791a2f31760d0aa833aa3f8601bccbdf9a72f9a86675", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:04.898Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 9242.767166000005, "promptTokens": 1475, "completionTokens": 1781, "reasoningTokens": 1641 }, { "requestSha256": "ee561c29d8fa76b49c163e4a0138b441d37e9733a4b41f84234c611884ac7552", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:14.146Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 8352.80591700002, "promptTokens": 1585, "completionTokens": 1692, "reasoningTokens": 1470 }, { "requestSha256": "dfdd0ec94cab3c05245457317b468dde2c717c0b4bbb4e6f47ffbfff876b97ae", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:22.506Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5856.737250000006, "promptTokens": 1625, "completionTokens": 1025, "reasoningTokens": 840 }, { "requestSha256": "233fbc6373a38b926b920843f7418153793db8f49868ae2b09b2299b2e907220", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:28.374Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 4011.975792000012, "promptTokens": 3543, "completionTokens": 696 }, { "requestSha256": "09ef5664569f59a5e392caebc26391667ebd338da67e72bfad8bd6e5efc2d31b", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:32.391Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3175.8729999999923, "promptTokens": 1614, "completionTokens": 442, "reasoningTokens": 313 }, { "requestSha256": "af17054be0ba00f18421d329a66ba408a92bc168f4cf8e2a17afb5a0a8ca9df3", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:35.570Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5367.383791, "promptTokens": 1614, "completionTokens": 963, "reasoningTokens": 783 }, { "requestSha256": "a9b55066572f4688b39efd917f9059903d18383753621a2fb93f39310a2f6d1d", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:33:40.945Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 10358.637832999986, "promptTokens": 1522, "completionTokens": 2075, "reasoningTokens": 1831 } ], "diagnostics": { "BenchmarkTest01007": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 54, "endLine": 55 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00615": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 53, "endLine": 53 }, { "cwe": "CWE-79", "startLine": 70, "endLine": 70 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 52, "endLine": 53 } ], "modelOnlyVerified": [ { "cwe": "CWE-22", "startLine": 52, "endLine": 53 } ], "servedCombined": [ { "cwe": "CWE-22", "startLine": 53, "endLine": 53 }, { "cwe": "CWE-79", "startLine": 70, "endLine": 70 } ] }, "BenchmarkTest00350": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 55, "endLine": 58 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00167": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 53, "endLine": 53 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 50, "endLine": 53 } ], "modelOnlyVerified": [ { "cwe": "CWE-78", "startLine": 50, "endLine": 53 } ], "servedCombined": [ { "cwe": "CWE-78", "startLine": 53, "endLine": 53 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "BenchmarkTest01015": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 42, "endLine": 44 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00451": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 47, "endLine": 47 } ], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 43, "endLine": 45 } ], "modelOnlyVerified": [ { "cwe": "CWE-79", "startLine": 43, "endLine": 45 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 47, "endLine": 47 } ] }, "BenchmarkTest00287": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00284": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 47, "endLine": 47 }, { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 44, "endLine": 47 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 44, "endLine": 47 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 47, "endLine": 47 }, { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] }, "BenchmarkTest00348": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 51, "endLine": 51 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00427": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 70, "endLine": 70 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 47, "endLine": 47 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 47, "endLine": 47 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-90", "startLine": 47, "endLine": 47 } ] }, "BenchmarkTest00600": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 50, "endLine": 53 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00160": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-94", "startLine": 48, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-94", "startLine": 48, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ] }, "BenchmarkTest00798": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00586": { "nativeDeterministic": [ { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyMapped": [ { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ] }, "BenchmarkTest00694": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-330", "startLine": 46, "endLine": 46 } ], "modelOnlyVerified": [ { "cwe": "CWE-330", "startLine": 46, "endLine": 46 } ], "servedCombined": [ { "cwe": "CWE-330", "startLine": 46, "endLine": 46 } ] }, "BenchmarkTest00626": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ], "modelOnlyMapped": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ], "modelOnlyVerified": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ], "servedCombined": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ] }, "BenchmarkTest01162": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 39, "endLine": 39 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-915", "startLine": 39, "endLine": 39 } ], "modelOnlyVerified": [ { "cwe": "CWE-915", "startLine": 39, "endLine": 39 } ], "servedCombined": [ { "cwe": "CWE-501", "startLine": 39, "endLine": 39 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-915", "startLine": 39, "endLine": 39 } ] }, "BenchmarkTest00338": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-501", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ] }, "BenchmarkTest00609": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00270": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 41, "endLine": 41 }, { "cwe": "CWE-79", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [ { "cwe": "CWE-502", "startLine": 41, "endLine": 41 } ], "modelOnlyVerified": [ { "cwe": "CWE-502", "startLine": 41, "endLine": 41 } ], "servedCombined": [ { "cwe": "CWE-502", "startLine": 41, "endLine": 41 }, { "cwe": "CWE-79", "startLine": 51, "endLine": 51 } ] }, "BenchmarkTest00419": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00655": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest00291": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00931": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 84, "endLine": 84 }, { "cwe": "CWE-611", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 63, "endLine": 65 } ], "modelOnlyVerified": [ { "cwe": "CWE-611", "startLine": 63, "endLine": 65 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 84, "endLine": 84 }, { "cwe": "CWE-611", "startLine": 65, "endLine": 65 } ] }, "BenchmarkTest00813": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "BenchmarkTest00981": { "nativeDeterministic": [ { "cwe": "CWE-614", "startLine": 71, "endLine": 71 } ], "modelOnlyMapped": [ { "cwe": "CWE-614", "startLine": 71, "endLine": 74 } ], "modelOnlyVerified": [ { "cwe": "CWE-614", "startLine": 71, "endLine": 74 } ], "servedCombined": [ { "cwe": "CWE-614", "startLine": 71, "endLine": 71 } ] }, "BenchmarkTest01117": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00217": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 58, "endLine": 58 }, { "cwe": "CWE-79", "startLine": 71, "endLine": 71 } ], "modelOnlyMapped": [ { "cwe": "CWE-643", "startLine": 54, "endLine": 58 } ], "modelOnlyVerified": [ { "cwe": "CWE-643", "startLine": 54, "endLine": 58 } ], "servedCombined": [ { "cwe": "CWE-643", "startLine": 58, "endLine": 58 }, { "cwe": "CWE-79", "startLine": 71, "endLine": 71 } ] } }, "gatingStats": [ { "batch": 1, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } }, { "batch": 2, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } }, { "batch": 3, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } }, { "batch": 4, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } } ], "batching": { "maxFiles": 8, "provenance": "Frozen protocol batching metadata", "batches": [ { "index": 1, "caseIds": [ "BenchmarkTest01007", "BenchmarkTest00350", "BenchmarkTest00160", "BenchmarkTest00626", "BenchmarkTest00338", "BenchmarkTest00609", "BenchmarkTest00291", "BenchmarkTest00931" ] }, { "index": 2, "caseIds": [ "BenchmarkTest00167", "BenchmarkTest01015", "BenchmarkTest00287", "BenchmarkTest00348", "BenchmarkTest00600", "BenchmarkTest00981", "BenchmarkTest01117", "BenchmarkTest00217" ] }, { "index": 3, "caseIds": [ "BenchmarkTest00615", "BenchmarkTest00284", "BenchmarkTest00427", "BenchmarkTest00798", "BenchmarkTest00586", "BenchmarkTest01162", "BenchmarkTest00270", "BenchmarkTest00813" ] }, { "index": 4, "caseIds": [ "BenchmarkTest00451", "BenchmarkTest00694", "BenchmarkTest00419", "BenchmarkTest00655" ] } ] } } }, "trials": [ { "name": "Initial prompt update, familiar cohort", "measurement": { "schemaVersion": 1, "protocolSha256": "1166bd01e53bbc5b658f1012688d6597bd11bc626afb8cd993df653ca72eb6bc", "frozenAt": "2026-10-22T09:14:15.851Z", "startedAt": "2026-10-22T09:14:47.969Z", "finishedAt": "2026-10-22T09:17:23.348Z", "suite": { "name": "OWASP BenchmarkPython v0.1 balanced 28-case model detection-stage pilot", "repository": "https://github.com/OWASP-Benchmark/BenchmarkPython", "revision": "f1291485808b66e20ddb6b01b10dc71b3df8c8ba", "labelsSha256": "6396f37c97cfd0c018db3d8750095ce6c678a083f83620cfb3e88fe27a46bb0c", "totalCases": 1230 }, "config": { "model": "deepseek-v4-flash", "baseUrl": "https://api.deepseek.com", "concurrency": 1, "timeoutMs": 240000, "reasoningEffort": "none", "chainReasoningEffort": "low" }, "runtime": { "bun": "1.3.11", "node": "v24.3.0", "platform": "darwin", "arch": "arm64" }, "sourceIdentities": [ { "path": "apps/scan-cli/package.json", "sha256": "cc9d0ae3f24a0f1a2858e9ff0663c4804b88c77f8e2b8cf8a8b1082dc0e3d024" }, { "path": "apps/scan-cli/src/analysis-cache.ts", "sha256": "d0baba6157b77cf5cba8f8f6ac59d7929442ca9f144081b3622af80fac1f147f" }, { "path": "apps/scan-cli/src/analysisCoverage.ts", "sha256": "e3e0ba94e08f15d16db22214b3169798241d27ace83e9c2b3339ac2fde0f8ae4" }, { "path": "apps/scan-cli/src/appmodel.ts", "sha256": "11cb10ad4dc07e45360addf350638c231942a34c8a94cb56dffd687d40658f9c" }, { "path": "apps/scan-cli/src/batching.ts", "sha256": "70bb6ae15948ac1bd35c6534b885783cc14eb5bdc91fa4d99cb055bbe1e9b7b3" }, { "path": "apps/scan-cli/src/bench.ts", "sha256": "ab27ed544a3cab9d34bad1525bf3667c6604a7bd8ff32f2ab1c81211f2686162" }, { "path": "apps/scan-cli/src/benchmark-scorecard.ts", "sha256": "025b9f1a2fa845985d9fafbb6e84e6a39557eb73eba6064fcc2486b9a45979ee" }, { "path": "apps/scan-cli/src/cassette.ts", "sha256": "a811a8a9037156049094648cddb02ea0fd28938e4d5d7f9ba7a5d520d8ddb1c2" }, { "path": "apps/scan-cli/src/context.ts", "sha256": "26e02925eb5f20405171950bb35d20aaf71aa67eade8482ea70e4c89ced0ac1e" }, { "path": "apps/scan-cli/src/coverage.ts", "sha256": "10c0366ba24dfeb8792f4e1b817293186c6f1b6471cc4d01b2dc4096abc9e910" }, { "path": "apps/scan-cli/src/coverageReport.ts", "sha256": "e8eed15e9df0baefcd94ace34fcf0e63119e87ac4bea3595c2a279a060687a19" }, { "path": "apps/scan-cli/src/deepdive.ts", "sha256": "49c5913019358f87477bc93cab3daaa391beb8ebc307b55637d8f1c9234d8de9" }, { "path": "apps/scan-cli/src/deepseek.ts", "sha256": "b922cbf013b81ed1c3d682ce6e67868a3526034efd011ca6eb78dfc7e1ad8543" }, { "path": "apps/scan-cli/src/defences.ts", "sha256": "fb11f03b658d149a5e74bd8a18c74f27dc74aa24152d301703a1126c5723478f" }, { "path": "apps/scan-cli/src/depGraph.ts", "sha256": "b2e354315743883ed58cdcb22b3e242267e27ad3745ae11903f5d93c278be1f0" }, { "path": "apps/scan-cli/src/dependency-observations.ts", "sha256": "d8c14d1d944f1870602d35ec2d2e5b297e161423a0ed242256c60927b922f02a" }, { "path": "apps/scan-cli/src/depth.ts", "sha256": "3d3a5bbcfae2360b1b8045c5bf997523ce289835d17cef5752732bb895fb6405" }, { "path": "apps/scan-cli/src/envNames.ts", "sha256": "97071edd26823ab361d481785c04066eedabe6a5866c425562f089b4c7cc2c69" }, { "path": "apps/scan-cli/src/finding-response.ts", "sha256": "645faff3e3e6f9bd1d7bb7a7f93dab6bdb3f28787f08a6b97670193b5af1dc4a" }, { "path": "apps/scan-cli/src/fingerprint.ts", "sha256": "058ef82e52a20e2207d5c356bf8780a4bb8c02e88873be4bc079539c77225306" }, { "path": "apps/scan-cli/src/gates.ts", "sha256": "cc1f057e50be79d3fd397994dfc1df202812f05cf117b0145716c9c86d02e377" }, { "path": "apps/scan-cli/src/gitleaks.ts", "sha256": "3b45e13abb74de4f204acb29c82b3c8a3c6628373fe91c590bd4ea377f9bec38" }, { "path": "apps/scan-cli/src/helpers.ts", "sha256": "ae9c19d7ff10118b3089d4709a04f0cc749083dfe23d3e0c865b692ac32cc4b6" }, { "path": "apps/scan-cli/src/iac.ts", "sha256": "78011b64b0c4da54861405f19b9e33fe9f5b42f5c2108330c9fe46f17fd033ed" }, { "path": "apps/scan-cli/src/image.ts", "sha256": "a7aa4b3605587ec02c07116058a720c7b894b34b000598010f67061bbc9e2e22" }, { "path": "apps/scan-cli/src/imports.ts", "sha256": "37e654e1643d66d1b4b3dd08a71f029c85221f24bc1857a52f4c289e536de42a" }, { "path": "apps/scan-cli/src/independent-benchmark.ts", "sha256": "44d2a86c3e10ea7b897800dec90f7e73fd7096bc575c4fbdac50308a4561f242" }, { "path": "apps/scan-cli/src/index.ts", "sha256": "28244b9a65713e5d5f4e5a5581de5302372e1a5436870f1543dc5936805fd632" }, { "path": "apps/scan-cli/src/intelligence.ts", "sha256": "93bfb294b41bdf1616533ac6445c271430497e0def81e6443ef723c6a35efc90" }, { "path": "apps/scan-cli/src/kernel.ts", "sha256": "18f2d1eeeeacc4b528e343c91cae0b08bc6e252427e886af5470730d8774d4f0" }, { "path": "apps/scan-cli/src/logger.ts", "sha256": "3d53733daa48af057f2709b29af2d0e506af3f62764ea64cd1b5758be0ba8582" }, { "path": "apps/scan-cli/src/manifests.ts", "sha256": "bb1672c1bd3c1d399c16878572874efbe5e648e33b88e61455ba98b574d04af7" }, { "path": "apps/scan-cli/src/mapFinding.ts", "sha256": "be3ec1f53d70c7f6021ad695ffc37363e46d2dd34b047c14ade59dce2401459a" }, { "path": "apps/scan-cli/src/model-benchmark.ts", "sha256": "2dafb947ad3453029da853432a0413dc93adb78ab88e4707e0802c8f2491a028" }, { "path": "apps/scan-cli/src/noise.ts", "sha256": "5d30d0453a93bd04a4bc10be6692d8a9813677dee35c7c3ba7af12ee7fb16bfa" }, { "path": "apps/scan-cli/src/oci.ts", "sha256": "c5600f5dbeb7e786ebcf0a75cf1d24c35314af3fcdcdc681feac7ad1154f7277" }, { "path": "apps/scan-cli/src/openapi.ts", "sha256": "6223b8611795454a8f0f52ec1f7bb577f19b144d41cb19dd226dc6c7168328c9" }, { "path": "apps/scan-cli/src/osdb.ts", "sha256": "cd464bb11b5953068934c17cde3f10bedaeaaed03fdf6d85cf267a2df0145e6b" }, { "path": "apps/scan-cli/src/prefilter.ts", "sha256": "53571e87886dbc160b0d64cac8a485c84d539c34e2a67bc07262350c2b83176f" }, { "path": "apps/scan-cli/src/prompts.ts", "sha256": "d5955b49d19e015c35afdd4fc46e69fa21f504230d285b65e6149d59cab53264" }, { "path": "apps/scan-cli/src/pullRequest.ts", "sha256": "2fbfa5525a0a9e9e0f9f35348429f397cc37bf22a897f779ea83e31a3d7c31bd" }, { "path": "apps/scan-cli/src/python-config.ts", "sha256": "cbd69945e59780938e88bbd3ba594696ad7c4fcfe00550e4a07102bd685e4065" }, { "path": "apps/scan-cli/src/python-flow.ts", "sha256": "ffc6d7325bbfefcc33b295998ee00ca3fb6fcf3af5df6391afff60a59ac34ade" }, { "path": "apps/scan-cli/src/quality.ts", "sha256": "7b69ff447ff7d673420eb84fc13c19b8b3a779f18bc01feb3c5c44166bcce40e" }, { "path": "apps/scan-cli/src/reachGraph.ts", "sha256": "099e451f8b1cf41d631d2831dba4629e4bc7ea0c31ce6b1291571e4f602dbd04" }, { "path": "apps/scan-cli/src/reachability.ts", "sha256": "fa01a82a0bca1a3ba67faca4f6fdc209fc0b81f099b59f70ead33dc6a1d5c24a" }, { "path": "apps/scan-cli/src/recovery.ts", "sha256": "c51f097dc8f7dfa1f0576c9c66fc459acb615122ad9e9d78b7ecad124b6c7e98" }, { "path": "apps/scan-cli/src/relatedSpans.ts", "sha256": "b455844c8a2dd2c8a91e56a291920ed34c7a3fb003c6cb285a82f2c5a92aaf2e" }, { "path": "apps/scan-cli/src/repoSecrets.ts", "sha256": "071dd5a1b259aa2cbf7adcd32b5a6010c69a8601711ae5a3f74117df35611d0f" }, { "path": "apps/scan-cli/src/reporter.ts", "sha256": "7c1ee9071898d0c47eb79c6542c7bd677933eda9f159f0dea9fcdcafc28bcbd6" }, { "path": "apps/scan-cli/src/repository-benchmark.ts", "sha256": "dc324cf0bf446082626a6bd31879782a6516149bd45d9293d7dbc519d7f08cb4" }, { "path": "apps/scan-cli/src/rule-defenses.ts", "sha256": "02e15e50eeefe594378f0cf7e9925d651df06561e64fe06365c7bcfdb3dcf1a1" }, { "path": "apps/scan-cli/src/rules.ts", "sha256": "4cd142f29398311478e0931f6f2cc0646d03d8f7448c423751927773996e4889" }, { "path": "apps/scan-cli/src/sbom.ts", "sha256": "2f76a139d11e49b67a826603881cbf81ffc4474bc4bd9fde6506e0c558c8f0d9" }, { "path": "apps/scan-cli/src/scan.ts", "sha256": "007d722679c2ad767b2cb643c2fadbb686ba1125e1e0e9fd667f5c481a9dff32" }, { "path": "apps/scan-cli/src/scanVersions.ts", "sha256": "5e3991039c32835b23767c90aafaa33ab15a6e61f7e01a9b0d3ab5683c602653" }, { "path": "apps/scan-cli/src/search.ts", "sha256": "f9db1c3b5fe9900a6e4f4335d53ada9083e2ae932ebcee853b56f527ba95f219" }, { "path": "apps/scan-cli/src/silence.ts", "sha256": "8c65ac7f0df90c9c15394ac6de861f86ce3d89a2930a8ebe7445d63eaa5e2787" }, { "path": "apps/scan-cli/src/spread.ts", "sha256": "2d80502b0d1b0d453aa0e2da7513fefdf75755a37d5af1e3cf6a5cb08b12d9d0" }, { "path": "apps/scan-cli/src/stability.ts", "sha256": "61012aae5957361f46a8f15413ea429e7350fefabce4e9e0e6fa972278cc34e7" }, { "path": "apps/scan-cli/src/stop.ts", "sha256": "d35e4491a63e6792342b8b5deea342a2b4bbe22975aeb6f26c51537e2275fd6f" }, { "path": "apps/scan-cli/src/sweep.ts", "sha256": "356678c7373530b517e05ab46e58d09df0eb7484a8bcca6f2b7b50a5753abc2b" }, { "path": "apps/scan-cli/src/tar.ts", "sha256": "2c80b52c78e9c75185ed90b3cd4f4a6bca969fe0d1c736f15f8b72e47773e6f6" }, { "path": "apps/scan-cli/src/template-flow.ts", "sha256": "435188aca557af792af85cb0553cac1361e075e2d3e007f8963b2e399810469b" }, { "path": "apps/scan-cli/src/tools.ts", "sha256": "cf9de13aa44e1550fdeedfba7e25ac7ccf36b289825a8eaf3f1928cf8b5df3d8" }, { "path": "apps/scan-cli/src/trivy.ts", "sha256": "150153c1b23996bc0f8a32301c65d0bff0be1fa2fae6cb7eb0f5c581c700c236" }, { "path": "apps/scan-cli/src/verdict-contract.ts", "sha256": "e24ab43d9f4cc96ebd2e3948286779b2e0b0390f42106f14b3b7eef3bcee9d61" }, { "path": "apps/scan-cli/src/verify.ts", "sha256": "a107310a1f21fff33e0642c492bd368858c4c46da73dedebfdf480f4931b8bfe" }, { "path": "apps/scan-cli/src/walk.ts", "sha256": "3d2a350dfe6e25403e50eefa3a0dbaebe275b422950717fc438be3bd5c74d097" }, { "path": "bun.lock", "sha256": "14b55bb0ae964bab83edb70d146e5e5eac16a7ef7418b4bd94842a5335edbbbd" }, { "path": "package.json", "sha256": "0c61121892bbd320487234c977f0e12f550a611adcb621d86d138c60cf0f6422" }, { "path": "packages/schemas/package.json", "sha256": "a46ecb31aa9aa33ceb6daafae8394ccdfa228fc7789198c421a02c0999aaa786" }, { "path": "packages/schemas/src/billing.ts", "sha256": "7ae419533da6bc2a20ad243b33b452dcd25d7dd67fe6c4b89c7d44193818322e" }, { "path": "packages/schemas/src/careers.ts", "sha256": "c367f27b05dfdc9d57e25fe9987bf21e78f3f65ea9556afccea999cbfc068c46" }, { "path": "packages/schemas/src/dependencyObservations.ts", "sha256": "d5a641b059b22592c692d3283502b9d77213ec42e77e03e600d0a20ee72d4038" }, { "path": "packages/schemas/src/findings.ts", "sha256": "a12c3448f1e41d2eda5313f9b9a8fcf64ed2b77ebc80e5e22a7c682060878a38" }, { "path": "packages/schemas/src/immunity.ts", "sha256": "cbe2557cc42d164e9d677f92ab8e26ce12762b4b2f60d5a3f2430b59a793abce" }, { "path": "packages/schemas/src/index.ts", "sha256": "dc8572d1089083d76301bdf8634bfe9565973f00e6cc49beca1101df17ec4cbe" }, { "path": "packages/schemas/src/investigation.ts", "sha256": "0a4a6a4370ff428910b2fb0ef53450fae064392dc58e341f8eb33da2252300b5" }, { "path": "packages/schemas/src/ir.ts", "sha256": "c1b1d0766b20e4830a9a6ab35d27ba16dc676f9a4c2a9badebd4fdbd17919df8" }, { "path": "packages/schemas/src/knowledge.ts", "sha256": "74488c0199366e71df6c2a83e71333317392e6b010e88f6beb66b935cec4bc85" }, { "path": "packages/schemas/src/notifications.ts", "sha256": "994d00573e810665c4379c2cb86147d28ac588ffca1b7f5c305cbd3ee98578c9" }, { "path": "packages/schemas/src/packages.ts", "sha256": "cabe240416e6c35be7baae9e776017e272f03efc5c4bcac3db05b3c11fa75d7e" }, { "path": "packages/schemas/src/proof.ts", "sha256": "80dcb156960b75ec0dee7e607fba08229ddc0cccb5c8951e813274b27340953f" }, { "path": "packages/schemas/src/reachability.ts", "sha256": "6f78887ccf9f09df85e9cad8b5c271fd036782846bcdd301de44e85645f86b39" }, { "path": "packages/schemas/src/reproduction.ts", "sha256": "ef08346d379d5f325bd579a7536679fef7d09fab7f4925392c55c55fd3aa7ab5" }, { "path": "packages/schemas/src/scanCompletion.ts", "sha256": "881dd9263b32be386c364e8595562cadf7e9cbda9efe5aa64abac11b798c7e8f" }, { "path": "packages/schemas/src/scanPullRequest.ts", "sha256": "09e56c5771b087884f735f69a3f3cb625f99e7aab1a867fd1f469fd1906ba2b6" }, { "path": "packages/schemas/src/scanReasons.ts", "sha256": "fba539e6d3c2140db2a329a6be9ce53e7ed0f6dc4437f085d2ce014be71d200a" }, { "path": "packages/schemas/src/secretRepair.ts", "sha256": "f139123f488ba9a19e2a22bcd02544986d0e056358876a3db51655f7d5a99be2" }, { "path": "packages/schemas/src/secrets.ts", "sha256": "e3a898bcadcbc68d0587b513db1d1945174437f358e0fe33624e97df50b42c00" }, { "path": "packages/schemas/src/security.ts", "sha256": "311afcee8ce9a869a622a19e2b1db1e57e003ace1f655921760ec21689a46f44" }, { "path": "packages/schemas/src/states.ts", "sha256": "540c39ae578d9f7cae4ab84e5e183852e6eb84ae49d1d992c2cbf8c2e81a66b6" }, { "path": "packages/schemas/src/wire.ts", "sha256": "b0c21292deadef07a17133b79eb89e4d3dc3dd6bfd165f61653efb699d9d6c3d" }, { "path": "packages/schemas/src/workspace.ts", "sha256": "17a5fab2b0f41f698fbe2f1eceb055c035ae04bec35f547c03531d2e0eefbf42" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/rule.yaml", "sha256": "add1d0987ffcb76cf8286d4da2210674893a8a8c693c9afacb5f4adbbfc7f73d" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/safe/sanitized_html.ts", "sha256": "0d602cd9ae708c8060652de16f1c361a5522dc81d81624e8bdaaaae2664457d2" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/vulnerable/bypass_trust_html.ts", "sha256": "dda816ef1b3d98aa23f109516466c901b66bee2cc3c4742f997ddbf75dac2165" }, { "path": "rulepacks/common/CLEARTEXT-001/rule.yaml", "sha256": "19d83cbe5fabd840248811236a6426d860695cc99d57105d7f67d71b46cfb809" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/safe/https_endpoint.ts", "sha256": "c497ad77c81fd53d387c2b5b10161388c87628740d0b678891581d330ab1ca03" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/vulnerable/ftp_endpoint.ts", "sha256": "c3a6c3a828cc4cdca45bbdf486c6c2856066163884baa74f760a91e896f11870" }, { "path": "rulepacks/common/CMDI-001/rule.yaml", "sha256": "76a524d4596595bec3d2b8550e593f8f73b2c463c594bb7a70f2cb8c3ea9346c" }, { "path": "rulepacks/common/CODE-001/rule.yaml", "sha256": "313aa196ab864dd25536b018605c1c3b36f18956a367376ee0e005bb319f58be" }, { "path": "rulepacks/common/CODE-001/tests/safe/comment_mentions_eval.ts", "sha256": "a47f8173953238cb60d08856a1b037366fbe536a88da34b23c643e9cad35d572" }, { "path": "rulepacks/common/CODE-001/tests/safe/literal_mentions_eval.ts", "sha256": "3d09dab28d07ba35d263943091655822f5f5d217b2d6fccbbf3f9cb435bacfc2" }, { "path": "rulepacks/common/CODE-001/tests/vulnerable/eval_query.ts", "sha256": "e3f4f0d3c518040aa2696ea7f76ff19db67601d38be08b42373615b3ded3dae0" }, { "path": "rulepacks/common/DESER-001/rule.yaml", "sha256": "20b2f7b0d2b0a0dbf7d8725589a031e8d7cb58d318d151d099bfc1c2e484dd79" }, { "path": "rulepacks/common/DESER-001/tests/safe/yaml_safe_load.ts", "sha256": "7aaaf0beb687fdadfafbc7d6d1a952647353a222571032ea59242f87bf33dba9" }, { "path": "rulepacks/common/DESER-001/tests/vulnerable/yaml_load_body.ts", "sha256": "f108c65e1710a394fa1785691e1cb6d621e3e0b778da96403788137e3156453a" }, { "path": "rulepacks/common/PATH-001/rule.yaml", "sha256": "b45b1cfe6d8c5af96ec1e8a1c837feeb8ddc239424adca3c188a64c161a00d2f" }, { "path": "rulepacks/common/PATH-001/tests/safe/read_normalized_path.ts", "sha256": "de57b93ba7c7f086a1a9de7d2872628ccb63d84da3fb2fa1ef195bf58b0d2ca6" }, { "path": "rulepacks/common/PATH-001/tests/safe/template_allowlisted.ts", "sha256": "d1d539bba782f1be978bfc1758690d38426278adaf1a44dbf76705e47ce6618b" }, { "path": "rulepacks/common/PATH-001/tests/vulnerable/read_user_path.ts", "sha256": "f1b1f2b69e5992f4004d8a30d0e696fb19d21cd1cb02927e61687e5991d7569d" }, { "path": "rulepacks/common/REDIR-001/rule.yaml", "sha256": "ebaba25880fec0039dad28bd24cbdd36541ab08036ce72527d31363ba37551f7" }, { "path": "rulepacks/common/REDIR-001/tests/safe/redirect_allowlist.ts", "sha256": "903c9879c7b4b35624849633a17e8a34a86dc25f4526cc3df5342b5bb0e49bde" }, { "path": "rulepacks/common/REDIR-001/tests/vulnerable/open_redirect.ts", "sha256": "efd4e225c944fb8647054fa952e40f0d6f3b3b905e22a6bf89f4b2c310daf363" }, { "path": "rulepacks/common/SQLI-001/rule.yaml", "sha256": "3e64945a2e853ae7bbd868a110edbca234966a170a03f3dfe6f49de7077c6fcc" }, { "path": "rulepacks/common/SQLI-001/tests/safe/drizzle_where.ts", "sha256": "106f09d70c246f993c7098b5d059bea9b836d1d025154d2c21b2b330519e7ceb" }, { "path": "rulepacks/common/SQLI-001/tests/safe/identifier_allowlist.ts", "sha256": "bca1e858b9fda6aff77dc1334c96e61446966250ab503c5832c0ef2919ce8436" }, { "path": "rulepacks/common/SQLI-001/tests/safe/parameterized_query.ts", "sha256": "bc711ba097116beaedf72e93c7b3b20b961a2d1258948ecb0dbe6e0ab8831a4c" }, { "path": "rulepacks/common/SQLI-001/tests/vulnerable/concat_query.ts", "sha256": "a2429d8b1f611d41495a356ac305368dc5b78092e491a43bedf6a0f663b6ecb8" }, { "path": "rulepacks/common/SSRF-001/rule.yaml", "sha256": "86bbbbd1f8bfe819cb8af8bde8ca5e43e038979c728fa8ad030641777a631f3e" }, { "path": "rulepacks/common/SSRF-001/tests/safe/express_proxy_allowlist.ts", "sha256": "571f26fc750cdb14b72c7803cd2dd50d62acd806d1677dd5165aa92060ecd21f" }, { "path": "rulepacks/common/SSRF-001/tests/vulnerable/express_proxy.ts", "sha256": "e4f646374bcb08c30fb8af627a91668f4841512cebe1bf804f79c0c4cc2229ab" }, { "path": "rulepacks/common/SSTI-001/rule.yaml", "sha256": "1cf2a5878dad69f9adf9cad88ea2000064898a51447e053a47ef05581954edde" }, { "path": "rulepacks/common/SSTI-001/tests/safe/precompiled_template.ts", "sha256": "0d5febf5ff8f2070115eaeba0870cdfcd392a2dd142487f0a996b04cc491a6e1" }, { "path": "rulepacks/common/SSTI-001/tests/vulnerable/handlebars_compile.ts", "sha256": "4b04998aa32236b06404c7c9aaf2674d01173576b2401efd4904166a4f30fd5f" }, { "path": "rulepacks/common/UPLOAD-001/rule.yaml", "sha256": "e5d8812fab296e63bb94fed6486797995e830fd2feedb5e4ac567bb7e904600b" }, { "path": "rulepacks/common/UPLOAD-001/tests/safe/mime_checked_upload.ts", "sha256": "e020db518e233ac8433f5237c1744d70d6854bd802dbd232f6377d1e03c9aa77" }, { "path": "rulepacks/common/UPLOAD-001/tests/vulnerable/unchecked_upload.ts", "sha256": "c2c4629e3af2db831f72d99572b49c758174bb224e4a2f4abb88ab82f12a3967" }, { "path": "rulepacks/common/XSS-001/rule.yaml", "sha256": "4eafa1e0a5329f76ec075e03d6bf756570cd1643ec4b1aaff9f4ae8960073237" }, { "path": "rulepacks/common/XSS-001/tests/safe/escaped_html.ts", "sha256": "199162c065905fc36a12bae5eedef52093de52b6faea7189b26c94fc4b297fd0" }, { "path": "rulepacks/common/XSS-001/tests/vulnerable/inner_html.ts", "sha256": "9bc3e7f70495dec60e4fae6e44c6525d1f7eed9eaab34f1b7f0c2f62ee334865" }, { "path": "rulepacks/javascript/CMDI-002/rule.yaml", "sha256": "ec140652bbbf75b9ac7abf0491617a7b2fedafec6b01e061afcc455fd46dfab2" }, { "path": "rulepacks/javascript/CODE-002/rule.yaml", "sha256": "5fba2995a7c08491b7fce10659cff11e00d9197bf59a5d3a38f93403ca398b63" }, { "path": "rulepacks/javascript/PATH-002/rule.yaml", "sha256": "6cd1dcc2bd021b507e56eda1048e2d556a7f2d63e174a387c55654dfd32b2fc1" }, { "path": "rulepacks/javascript/PROTO-001/rule.yaml", "sha256": "bf376e71fc05a878df13da0e52dad459fb0c3fd64022d8a69733f3714f6c0ee7" }, { "path": "rulepacks/javascript/PROTO-002/rule.yaml", "sha256": "a33eb6189979feb4815736b9b41878181409cb6582bcbc84cf8b570a8ca6fdde" }, { "path": "rulepacks/javascript/REDOS-001/rule.yaml", "sha256": "b20709f91bfe5bc2b834174a53fb2d0aa2772fd21838191273c117a662d7fbbc" }, { "path": "rulepacks/javascript/REDOS-002/rule.yaml", "sha256": "96c5b0ca1b87ccfd62d47a5cdf0333b9aeb8af676e57db2cb1bf51071a01f128" }, { "path": "rulepacks/javascript/REDOS-003/rule.yaml", "sha256": "1cc53d782185aed8c25f674342c6e25c26bf4fe7d28c11149cd7d4e6c00591b1" }, { "path": "rulepacks/javascript/REDOS-004/rule.yaml", "sha256": "4fc5fa489991681c7b6c7c8fdab2271f0e482c5bdf65cbdb1a5ed14fcc79fefa" }, { "path": "rulepacks/javascript/XSS-002/rule.yaml", "sha256": "265b5dddc5503e3cfede82589a20346e7111aee234aae699bd72010284ab4819" }, { "path": "rulepacks/python/COOKIE-001/rule.yaml", "sha256": "e96b7b90b587fa6d110a094a04a62e892ea7c3e568dc3348cb91152dc31b28eb" }, { "path": "rulepacks/python/DESER-002/rule.yaml", "sha256": "a77cd0730f50c608ddaa4d8446adb7b728522990b1cd772a96648113e522c731" }, { "path": "rulepacks/python/HASH-001/rule.yaml", "sha256": "e73bc710813e3432d33ebd5c3009af465ff431828a6f62023f8134284cb2952c" }, { "path": "rulepacks/python/LDAP-001/rule.yaml", "sha256": "ba5af874b16aced31442688c2696bdce5d653e06777cb8405ba4827fe81299d9" }, { "path": "rulepacks/python/PYEXEC-001/rule.yaml", "sha256": "e894bf53024edc28c99465d76e0ba6cf0041a365c3e47d886f8fa2d4bb9d978f" }, { "path": "rulepacks/python/RANDOM-001/rule.yaml", "sha256": "cc5ef82221e457cd3735ddf1a2460f0ad1b4c0a42d8d046dc6eb8826c8a4401e" }, { "path": "rulepacks/python/SQLI-002/rule.yaml", "sha256": "8870d9e0c8e50ef1e98bdd0a5d340a993fd08bb79c99b83ab0d5d428532efd3c" }, { "path": "rulepacks/python/SSTI-002/rule.yaml", "sha256": "9eaef2a4dd0a2a05427b38d57224363493ae4d6084de444cb972abe363b4a7e5" }, { "path": "rulepacks/python/TRUST-001/rule.yaml", "sha256": "951696eaf7ece7422b37a1fa86d5985f8d3b128d583ce50df98520a877896372" }, { "path": "rulepacks/python/XPATH-001/rule.yaml", "sha256": "17604e33d66d6d7e378932a5979beba8bd09166a0c9bb9fe298cd448ba34d43b" }, { "path": "rulepacks/python/XXE-001/rule.yaml", "sha256": "560eadedab50b15f003f19895559b947ef17958200940ab1099a351b3278bc4d" } ], "selection": { "seed": "cefense-model-stage-pilot-2026-10-21:", "procedure": "Partition all 1230 author-labelled cases by exact expected CWE and vulnerable boolean. Select minimum SHA-256(seed + original case ID) in each of 28 strata. No detector predictions used. Manually inspect selected source before any model inference and declare security operation statement lines. Keep author labels without adjudication.", "selectedCases": 28, "corpusCases": 1230, "unselectedCases": 1202, "caseManifestSha256": "f553622a791a8376dcc78b1dd2e85fe00b89f83b428431b1ccdf546cfb790f1a", "caseIds": [ "BenchmarkTest00094", "BenchmarkTest00620", "BenchmarkTest00588", "BenchmarkTest00641", "BenchmarkTest00780", "BenchmarkTest01047", "BenchmarkTest00152", "BenchmarkTest00497", "BenchmarkTest00660", "BenchmarkTest00898", "BenchmarkTest01209", "BenchmarkTest00068", "BenchmarkTest00292", "BenchmarkTest00541", "BenchmarkTest00415", "BenchmarkTest00494", "BenchmarkTest00943", "BenchmarkTest00844", "BenchmarkTest00512", "BenchmarkTest00511", "BenchmarkTest00452", "BenchmarkTest00841", "BenchmarkTest00012", "BenchmarkTest00099", "BenchmarkTest00991", "BenchmarkTest01200", "BenchmarkTest00818", "BenchmarkTest00161" ], "sinkReview": "Read all 28 selected source post handlers. Anchors identify file reads/writes, digest/token creation, session assignment, parser configuration and parse, cookie security arguments, XPath/SQL/LDAP/command execution, returned HTML construction, or eval/exec. No engine predictions used." }, "plan": { "mode": "default", "maxRounds": 1, "sweepEffort": "none", "verifyEffort": "low", "verifyEnabled": true, "minConfidence": 0.4, "absenceLane": true, "spread": false, "secondOpinion": false, "verifyEngineFindings": false }, "limits": { "requests": 80, "tokens": 600000, "dollars": 0.48 }, "scope": "Production detection-stage prompt, snippet mapping gates, configured verification and native union policy. Selected source files only, with imported helper bodies absent. No intelligence retrieval, repository execution, additional sweep/absence/spread/chain lanes, PR generation or full hosted scan. Public label-known corpus, not independent held-out accuracy. Labels and suite identifiers are not model messages. Native findings are never deleted by model review.", "targetPlatform": "unknown", "prices": { "inputUsdPerMillion": 0.3, "outputUsdPerMillion": 1.2, "source": "https://api-docs.deepseek.com/quick_start/pricing/", "checkedAt": "2026-10-22T09:14:15.750Z" }, "planned": 28, "corpusCases": 1230, "unselectedCases": 1202, "scores": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 6, "fn": 8, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 6, "fn": 8, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 0, "tn": 14, "scored": 28, "failed": 0, "notRun": 0 } }, "cases": [ { "id": "BenchmarkTest00094", "path": "testcode/BenchmarkTest00094.py", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "6d58cbd52ca9fc3034ee584df73a332dd800c7b05f78eeada7b2fce5468564ac", "sanitizedSha256": "c23327edcef3c0fc1e3c8017df45f892614053d99184cd5893424e6226678ace", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00620", "path": "testcode/BenchmarkTest00620.py", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "9b9fccb8bcc532fbfac2ae326052601a7ac254aa18593061f48288de83785815", "sanitizedSha256": "19af4b10ae41270b62704d05fb38fdb75b63418024f44b658ef31258705b8ca2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00588", "path": "testcode/BenchmarkTest00588.py", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "2097e8a4f2078e05af37d09e86842b5da07540c5cbb9b8f01d4b2ce3c74955ed", "sanitizedSha256": "e34bfe69619f47e35b068ca4c6b442826586bcd5bc311357a3e43ffcac9af56f", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00641", "path": "testcode/BenchmarkTest00641.py", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 59 ], "sourceSha256": "4fc4f18e551532d6e5c5770c3fd880e45ddfa640b2940640ea1314bc11866dc9", "sanitizedSha256": "8fa27d2ee4f2f54bc07603f9731b33630c96a973d1e4687565a76b5a4f316761", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00780", "path": "testcode/BenchmarkTest00780.py", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "4f30eabc02460c9ecc265a6eec4246c127a2a3f5737396caeed690f4433b3529", "sanitizedSha256": "86aaf74f87b7cfdb4cdc34e05fe84eed23ed2924d145fbea504bf45903e3ccbf", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest01047", "path": "testcode/BenchmarkTest01047.py", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 51 ], "sourceSha256": "6dccd0db84942c9c4e6f0f5409f5c17b59d7d9f44e1dac01f14742f424333dd4", "sanitizedSha256": "26b4f5645e2bc9e0aaceec1660e8a687795545000db6e35bf28f4f8374e8c37d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00152", "path": "testcode/BenchmarkTest00152.py", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 46 ], "sourceSha256": "a6d5fa4938575080e0fd8faa148ec54d7b9b7bd9ef497b786ca92b00a5d38b19", "sanitizedSha256": "da544e6f59d80088434136924e9cfc3294dc3d063fd65b9cc260ff774384280a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00497", "path": "testcode/BenchmarkTest00497.py", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 43 ], "sourceSha256": "1517d597c46bd244623bdbcb967aa74253336d18be567d17a5a6360184c5bc60", "sanitizedSha256": "250fdfaaa7a2cbe7b321c733d20830526030ee208fdd0a9b57f1b682f0a01fbd", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00660", "path": "testcode/BenchmarkTest00660.py", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "821b3e9b3a263dd794e91f54f4f21c22edbd6018244362e86421d81a02c0d0f1", "sanitizedSha256": "3215cbcad8c8b70aeae32061d63bfcfba112fa8738ed5eb5936a7f8017260968", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00898", "path": "testcode/BenchmarkTest00898.py", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "5c782040ab1d3e8d646b066db97acd6ff9e773d0678df2f5cb698e4f43e73c89", "sanitizedSha256": "7ece7e655428e4b5b0a23756f89b0c1b98506d5c51cb363094dd996cb451f29c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest01209", "path": "testcode/BenchmarkTest01209.py", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 52 ], "sourceSha256": "779b5c720bcb41995b43011dee489c78ff5ee09ffa55de38d3294606296a809a", "sanitizedSha256": "080ab63157fea0a652236be9ca752594696693b6894bf8453807e04f3306b553", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00068", "path": "testcode/BenchmarkTest00068.py", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "1787d21ef653eb0944bffd9be105d752d3f09c00be6ba34b3206e05fc479cf0d", "sanitizedSha256": "a3aace8bc3803c6c445aeab638942198fa613bd5d740e8d6241ff853308caf86", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00292", "path": "testcode/BenchmarkTest00292.py", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "de3a9938d7d30ece54248c7df2056c090c57b250637805fe61d066c1dd8d9399", "sanitizedSha256": "3a0aaa09e3b01c35120eb953c74e7b5eed5eaaa8fb4bcb1ea7b85f5403fe7c3e", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00541", "path": "testcode/BenchmarkTest00541.py", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 48, 50 ], "sourceSha256": "04a4794c16d853fa15c0b6b2194553d6d152c540511a79605557b447d826df17", "sanitizedSha256": "d4d103d429fb941ec3eff71bb10413ea2f775e3b313a1efcbdc9f6f776f56b66", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00415", "path": "testcode/BenchmarkTest00415.py", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 62, 63, 64, 65 ], "sourceSha256": "23e107c4b9ebcab6cc4f657ace95900cc7b7a5eb26feee839aacc12144ed6fd2", "sanitizedSha256": "92db41af40d6faf108a63a8dfa4a8cdadb76f82fb4d33fc2266aa22afb31aca2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00494", "path": "testcode/BenchmarkTest00494.py", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 57, 58, 59, 60 ], "sourceSha256": "978f1986c2920bd9dd0bd5b6703dbb2ad7265a5e1a378811cd6ee87db5747e80", "sanitizedSha256": "652848fd250683063d678bc40ab7f3e738f33d5463a15ebaf48f11635231df33", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 3 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00943", "path": "testcode/BenchmarkTest00943.py", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 55 ], "sourceSha256": "fcc315f3aa65053fa6aee6e1d2f7954b5ec7d2157d18dfabb67ffc6658b2c22f", "sanitizedSha256": "959ec149bee3a3586f2e9431be7590d07b067aeee6126204a78b94cb02fa2a74", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00844", "path": "testcode/BenchmarkTest00844.py", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 50 ], "sourceSha256": "b90be9de8a393bb2d4d1a12b83096f7a855df6f3955d7e6b0b20fb5f8863ed33", "sanitizedSha256": "9f8b24f1afd957380f0f3293f62542c5140f8344087d2c496d5173394088604b", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00512", "path": "testcode/BenchmarkTest00512.py", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 56 ], "sourceSha256": "6fea4f65eb817b5051660be2a3cdc3378356fc7a8aab31dda3cf8cc3b2f4015d", "sanitizedSha256": "51f8b86636d07663960930bb8d104216a30637425989014e9d451f541deeaaa5", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00511", "path": "testcode/BenchmarkTest00511.py", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 57 ], "sourceSha256": "60eb453e6e3ddcff7e1576e617c58fe4736cca9b736ae11e2c9a5489c95b08e1", "sanitizedSha256": "ae1042fa6ef12dcc0bfe15e5f51848e379e30f94fdefba340041da51be15b7b7", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00452", "path": "testcode/BenchmarkTest00452.py", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 43, 44, 45, 47 ], "sourceSha256": "3d46a83230d60675ba311acc08820590fb94b20e2c8cd1a12cbaf97ee74a14ea", "sanitizedSha256": "eb471b5429c061e8d71f27372c6bae7159c736b9a9b0d96e27efba1c00ba24da", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00841", "path": "testcode/BenchmarkTest00841.py", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 49, 50, 51, 53 ], "sourceSha256": "2c85fcc002dfa639dc9ad5e26f0b89f2b0bcfd718397cf54c2ffbb6f335e9dcc", "sanitizedSha256": "425294c7e17559bcdd034281fa3a302fe56538d3a82f2c1b4e2dbf81270a689d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00012", "path": "testcode/BenchmarkTest00012.py", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "fd90bac85ce2fe311dedb3372dc8ec4037dbe6de2d4955bcc89cdb56187cffd7", "sanitizedSha256": "88f82e23c6876c77323c0938d2680488b76c913646790f365ce5564a6f5ee09c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00099", "path": "testcode/BenchmarkTest00099.py", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "70a1ae553181b4ea78e6dec87c0c7ca73fdf1a9babbfeec062ea3465a8e64f8c", "sanitizedSha256": "2a8a3855f61181dc2261b7431fe6c24e7e89fe5a1e3da9f42e9485d7133fd7c8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00991", "path": "testcode/BenchmarkTest00991.py", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 60 ], "sourceSha256": "0d2015bf5a576c79c9c0d74d309a4cc8c1723b88d160230cf6802704604f5007", "sanitizedSha256": "dc41ace1485480328cce72e3c15e34a96eba89a732e0bb737c564215210a57e8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest01200", "path": "testcode/BenchmarkTest01200.py", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 45 ], "sourceSha256": "f3946bad750473f59f5840bd770f67c0bf4cc1769b66d31829596aec3fba0206", "sanitizedSha256": "c4e35c08ad100ca41a71c152ff38fdd0b60453edea6ff7f0b534343eb5d49824", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00818", "path": "testcode/BenchmarkTest00818.py", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 49 ], "sourceSha256": "03e86c5de51c8f0e9a01331571f53852b6d80405e23fccfbfd48ccb727650ee6", "sanitizedSha256": "643d34c01818b153a76f46edb92af152d79e8c563c732e766377bddef6aea8ac", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00161", "path": "testcode/BenchmarkTest00161.py", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 40 ], "sourceSha256": "5b7fff85449c25547a5beea20039187be606733bbbfef06d0ef431d896395a8b", "sanitizedSha256": "96804ff42dce0d994d41b825a8eba49452c5e5a38faa68a5724e461581beb802", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } } ], "servedCombinedPolicy": "Native deterministic findings are preserved and unioned with production-verified model findings using filterNovel. Model failures do not remove native positives and are not scored as safe negatives.", "usage": { "requests": 16, "tokens": 67688, "dollars": 0.0472884, "costUsdUpperBound": 0.0472884, "measuredPromptTokens": 37708, "measuredCompletionTokens": 29980, "unknownUsageRequests": 0, "latencyMs": 154343.50849900005, "accountingPolicy": "Configured peak cache-miss input and output upper bounds. Completion tokens include provider thinking tokens; cached-input discounts are not credited. Missing usage or interrupted attempts retain full reservation. Actual account billing is not independently verified." }, "providerModels": [ "deepseek-flash" ], "requests": [ { "requestSha256": "ec3b63a4d7072edc0f1a5ac3ea1d2b2a9d19f7b95755e49a38b8213f84531ce7", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:14:48.212Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 16369.003458, "promptTokens": 13393, "completionTokens": 3732 }, { "requestSha256": "82a2dac055eec13c4b7c7e775489ab7b5ebe4c801319cc75b6c91743d006ec45", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:15:04.601Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 38353.573083, "promptTokens": 1658, "completionTokens": 8231, "reasoningTokens": 8070 }, { "requestSha256": "4faeff5437a33ada40a19865f4ba6bb77c12da752aa2466a9c1c40d17c7c9096", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:15:42.953Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3382.3506659999985, "promptTokens": 1558, "completionTokens": 452, "reasoningTokens": 261 }, { "requestSha256": "373fd59fab2fc78cd6b68dcb223aa7eeab52b87ac0e9cd5111fb1a25a308f85a", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:15:46.586Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 7212.322375000003, "promptTokens": 1614, "completionTokens": 1146, "reasoningTokens": 950 }, { "requestSha256": "c188aeedfbaa29e6aae6b354118ba2d9b1850d3a6da245124ef7a4a71345c8a9", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:15:53.822Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5329.710500000001, "promptTokens": 1636, "completionTokens": 741, "reasoningTokens": 622 }, { "requestSha256": "aecac5ef651bede1057271ffa1dba9640397048547f1b9c2ca5cbb29b471f974", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:15:59.154Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6137.600084000005, "promptTokens": 1861, "completionTokens": 1256, "reasoningTokens": 1020 }, { "requestSha256": "304fb3ac841bac097b47eb03cbb455beb49dbb190a0448687bff0e88c6524bf3", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:16:05.314Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2219.4721250000002, "promptTokens": 1706, "completionTokens": 276, "reasoningTokens": 117 }, { "requestSha256": "b90585be2c6eccfd1b445fd89ce6273d5b34074e6b3c77eb5562ce4e664a9b1f", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:16:07.595Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2195.341834000006, "promptTokens": 1605, "completionTokens": 279, "reasoningTokens": 129 }, { "requestSha256": "abbc1ef221cf5a42e06978fc4cb3a873bea53c21fde500c54edce392ac7982ac", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:16:09.794Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3055.5168330000015, "promptTokens": 1602, "completionTokens": 473, "reasoningTokens": 299 }, { "requestSha256": "c4b748349089a7914f70823e56bd27e3aded8d0257f8905e1f25ca179f3a15c4", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:16:12.852Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 4198.2537500000035, "promptTokens": 1581, "completionTokens": 758, "reasoningTokens": 590 }, { "requestSha256": "f10eef17f336164bc7333cfe65057a4c349735e453c720274a8c35fb6b853605", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:16:17.117Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 38535.67654099999, "promptTokens": 1577, "completionTokens": 7572, "reasoningTokens": 7284 }, { "requestSha256": "6692e0984349a6f1d5c99ed8bfe52ec2fbcaea0588137af2fb15e65ccc300f10", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:16:55.656Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5212.860959000012, "promptTokens": 1647, "completionTokens": 1098, "reasoningTokens": 889 }, { "requestSha256": "fffbbc00571e695a5c49ef30d8ed915360c2fb3805eddd5736fffa4fd876208e", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:17:00.880Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3537.975582999992, "promptTokens": 1625, "completionTokens": 452, "reasoningTokens": 282 }, { "requestSha256": "ee525831e4ff32a197e9d67d6c7051a2ab9db0b9f3dece948e96a651310079e1", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:17:04.529Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 7628.686833000014, "promptTokens": 1586, "completionTokens": 1314, "reasoningTokens": 1117 }, { "requestSha256": "9993078f8e521bfa720d631d84d4e54bfc45315e89e67d3c5fae6435bebf7eb4", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:17:12.162Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5827.400874999992, "promptTokens": 1601, "completionTokens": 1112, "reasoningTokens": 912 }, { "requestSha256": "f91ec9782d0cb7f65b321d9519f97ecfc8270d0f51f5ab34e551262b94e34119", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:17:18.157Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5147.763000000006, "promptTokens": 1458, "completionTokens": 1088, "reasoningTokens": 931 } ], "diagnostics": { "BenchmarkTest00094": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00620": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-22", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-22", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 60, "endLine": 60 } ] }, "BenchmarkTest00588": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 66, "endLine": 66 } ] }, "BenchmarkTest00641": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 } ], "modelOnlyMapped": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ], "modelOnlyVerified": [ { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 70, "endLine": 70 }, { "cwe": "CWE-328", "startLine": 59, "endLine": 59 }, { "cwe": "CWE-327", "startLine": 59, "endLine": 59 } ] }, "BenchmarkTest00780": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest01047": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "modelOnlyVerified": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ], "servedCombined": [ { "cwe": "CWE-330", "startLine": 51, "endLine": 51 } ] }, "BenchmarkTest00152": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00497": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [ { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ], "modelOnlyVerified": [ { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ], "servedCombined": [ { "cwe": "CWE-501", "startLine": 43, "endLine": 43 }, { "cwe": "CWE-79", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-384", "startLine": 43, "endLine": 43 } ] }, "BenchmarkTest00660": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00898": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-502", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-502", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest01209": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 52, "endLine": 52 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00068": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest00292": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 73, "endLine": 73 } ] }, "BenchmarkTest00541": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 69, "endLine": 69 }, { "cwe": "CWE-611", "startLine": 50, "endLine": 50 } ] }, "BenchmarkTest00415": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00494": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ], "modelOnlyMapped": [ { "cwe": "CWE-614", "startLine": 57, "endLine": 60 } ], "modelOnlyVerified": [ { "cwe": "CWE-614", "startLine": 57, "endLine": 60 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 }, { "cwe": "CWE-614", "startLine": 57, "endLine": 57 } ] }, "BenchmarkTest00943": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00844": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-643", "startLine": 50, "endLine": 50 }, { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "BenchmarkTest00512": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 56, "endLine": 56 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00511": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 } ], "modelOnlyVerified": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 } ], "servedCombined": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 57 }, { "cwe": "CWE-79", "startLine": 62, "endLine": 62 } ] }, "BenchmarkTest00452": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00841": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] }, "BenchmarkTest00012": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00099": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 55, "endLine": 55 } ] }, "BenchmarkTest00991": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 57, "endLine": 57 } ] }, "BenchmarkTest01200": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 }, { "cwe": "CWE-90", "startLine": 42, "endLine": 42 } ] }, "BenchmarkTest00818": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ] }, "BenchmarkTest00161": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 40, "endLine": 40 } ], "modelOnlyVerified": [ { "cwe": "CWE-95", "startLine": 40, "endLine": 40 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 40, "endLine": 40 }, { "cwe": "CWE-79", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-95", "startLine": 40, "endLine": 40 } ] } }, "gatingStats": [ { "batch": 1, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 1 } } ], "batching": { "maxFiles": null, "provenance": "Legacy single-batch protocol reconstruction", "batches": [ { "index": 1, "caseIds": [ "BenchmarkTest00094", "BenchmarkTest00620", "BenchmarkTest00588", "BenchmarkTest00641", "BenchmarkTest00780", "BenchmarkTest01047", "BenchmarkTest00152", "BenchmarkTest00497", "BenchmarkTest00660", "BenchmarkTest00898", "BenchmarkTest01209", "BenchmarkTest00068", "BenchmarkTest00292", "BenchmarkTest00541", "BenchmarkTest00415", "BenchmarkTest00494", "BenchmarkTest00943", "BenchmarkTest00844", "BenchmarkTest00512", "BenchmarkTest00511", "BenchmarkTest00452", "BenchmarkTest00841", "BenchmarkTest00012", "BenchmarkTest00099", "BenchmarkTest00991", "BenchmarkTest01200", "BenchmarkTest00818", "BenchmarkTest00161" ] } ] } }, "rawReceiptPath": "/benchmarks/model-trial-development-2026-10-22-50cbfb92a5604ca7.json", "receiptSha256": "50cbfb92a5604ca7328d458d0e86d137b40a05d564064c530cec35a63bf0def6" }, { "name": "Initial prompt update, first untouched cohort", "measurement": { "schemaVersion": 1, "protocolSha256": "bfdcd0e0edacc662d44d75759e83f19277139f50af38410259ea7c851cf7f9ba", "frozenAt": "2026-10-22T09:14:16.060Z", "startedAt": "2026-10-22T09:17:44.948Z", "finishedAt": "2026-10-22T09:21:03.139Z", "suite": { "name": "OWASP BenchmarkPython v0.1 balanced 28-case model detection-stage pilot", "repository": "https://github.com/OWASP-Benchmark/BenchmarkPython", "revision": "f1291485808b66e20ddb6b01b10dc71b3df8c8ba", "labelsSha256": "6396f37c97cfd0c018db3d8750095ce6c678a083f83620cfb3e88fe27a46bb0c", "totalCases": 1230 }, "config": { "model": "deepseek-v4-flash", "baseUrl": "https://api.deepseek.com", "concurrency": 1, "timeoutMs": 240000, "reasoningEffort": "none", "chainReasoningEffort": "low" }, "runtime": { "bun": "1.3.11", "node": "v24.3.0", "platform": "darwin", "arch": "arm64" }, "sourceIdentities": [ { "path": "apps/scan-cli/package.json", "sha256": "cc9d0ae3f24a0f1a2858e9ff0663c4804b88c77f8e2b8cf8a8b1082dc0e3d024" }, { "path": "apps/scan-cli/src/analysis-cache.ts", "sha256": "d0baba6157b77cf5cba8f8f6ac59d7929442ca9f144081b3622af80fac1f147f" }, { "path": "apps/scan-cli/src/analysisCoverage.ts", "sha256": "e3e0ba94e08f15d16db22214b3169798241d27ace83e9c2b3339ac2fde0f8ae4" }, { "path": "apps/scan-cli/src/appmodel.ts", "sha256": "11cb10ad4dc07e45360addf350638c231942a34c8a94cb56dffd687d40658f9c" }, { "path": "apps/scan-cli/src/batching.ts", "sha256": "70bb6ae15948ac1bd35c6534b885783cc14eb5bdc91fa4d99cb055bbe1e9b7b3" }, { "path": "apps/scan-cli/src/bench.ts", "sha256": "ab27ed544a3cab9d34bad1525bf3667c6604a7bd8ff32f2ab1c81211f2686162" }, { "path": "apps/scan-cli/src/benchmark-scorecard.ts", "sha256": "025b9f1a2fa845985d9fafbb6e84e6a39557eb73eba6064fcc2486b9a45979ee" }, { "path": "apps/scan-cli/src/cassette.ts", "sha256": "a811a8a9037156049094648cddb02ea0fd28938e4d5d7f9ba7a5d520d8ddb1c2" }, { "path": "apps/scan-cli/src/context.ts", "sha256": "26e02925eb5f20405171950bb35d20aaf71aa67eade8482ea70e4c89ced0ac1e" }, { "path": "apps/scan-cli/src/coverage.ts", "sha256": "10c0366ba24dfeb8792f4e1b817293186c6f1b6471cc4d01b2dc4096abc9e910" }, { "path": "apps/scan-cli/src/coverageReport.ts", "sha256": "e8eed15e9df0baefcd94ace34fcf0e63119e87ac4bea3595c2a279a060687a19" }, { "path": "apps/scan-cli/src/deepdive.ts", "sha256": "49c5913019358f87477bc93cab3daaa391beb8ebc307b55637d8f1c9234d8de9" }, { "path": "apps/scan-cli/src/deepseek.ts", "sha256": "b922cbf013b81ed1c3d682ce6e67868a3526034efd011ca6eb78dfc7e1ad8543" }, { "path": "apps/scan-cli/src/defences.ts", "sha256": "fb11f03b658d149a5e74bd8a18c74f27dc74aa24152d301703a1126c5723478f" }, { "path": "apps/scan-cli/src/depGraph.ts", "sha256": "b2e354315743883ed58cdcb22b3e242267e27ad3745ae11903f5d93c278be1f0" }, { "path": "apps/scan-cli/src/dependency-observations.ts", "sha256": "d8c14d1d944f1870602d35ec2d2e5b297e161423a0ed242256c60927b922f02a" }, { "path": "apps/scan-cli/src/depth.ts", "sha256": "3d3a5bbcfae2360b1b8045c5bf997523ce289835d17cef5752732bb895fb6405" }, { "path": "apps/scan-cli/src/envNames.ts", "sha256": "97071edd26823ab361d481785c04066eedabe6a5866c425562f089b4c7cc2c69" }, { "path": "apps/scan-cli/src/finding-response.ts", "sha256": "645faff3e3e6f9bd1d7bb7a7f93dab6bdb3f28787f08a6b97670193b5af1dc4a" }, { "path": "apps/scan-cli/src/fingerprint.ts", "sha256": "058ef82e52a20e2207d5c356bf8780a4bb8c02e88873be4bc079539c77225306" }, { "path": "apps/scan-cli/src/gates.ts", "sha256": "cc1f057e50be79d3fd397994dfc1df202812f05cf117b0145716c9c86d02e377" }, { "path": "apps/scan-cli/src/gitleaks.ts", "sha256": "3b45e13abb74de4f204acb29c82b3c8a3c6628373fe91c590bd4ea377f9bec38" }, { "path": "apps/scan-cli/src/helpers.ts", "sha256": "ae9c19d7ff10118b3089d4709a04f0cc749083dfe23d3e0c865b692ac32cc4b6" }, { "path": "apps/scan-cli/src/iac.ts", "sha256": "78011b64b0c4da54861405f19b9e33fe9f5b42f5c2108330c9fe46f17fd033ed" }, { "path": "apps/scan-cli/src/image.ts", "sha256": "a7aa4b3605587ec02c07116058a720c7b894b34b000598010f67061bbc9e2e22" }, { "path": "apps/scan-cli/src/imports.ts", "sha256": "37e654e1643d66d1b4b3dd08a71f029c85221f24bc1857a52f4c289e536de42a" }, { "path": "apps/scan-cli/src/independent-benchmark.ts", "sha256": "44d2a86c3e10ea7b897800dec90f7e73fd7096bc575c4fbdac50308a4561f242" }, { "path": "apps/scan-cli/src/index.ts", "sha256": "28244b9a65713e5d5f4e5a5581de5302372e1a5436870f1543dc5936805fd632" }, { "path": "apps/scan-cli/src/intelligence.ts", "sha256": "93bfb294b41bdf1616533ac6445c271430497e0def81e6443ef723c6a35efc90" }, { "path": "apps/scan-cli/src/kernel.ts", "sha256": "18f2d1eeeeacc4b528e343c91cae0b08bc6e252427e886af5470730d8774d4f0" }, { "path": "apps/scan-cli/src/logger.ts", "sha256": "3d53733daa48af057f2709b29af2d0e506af3f62764ea64cd1b5758be0ba8582" }, { "path": "apps/scan-cli/src/manifests.ts", "sha256": "bb1672c1bd3c1d399c16878572874efbe5e648e33b88e61455ba98b574d04af7" }, { "path": "apps/scan-cli/src/mapFinding.ts", "sha256": "be3ec1f53d70c7f6021ad695ffc37363e46d2dd34b047c14ade59dce2401459a" }, { "path": "apps/scan-cli/src/model-benchmark.ts", "sha256": "2dafb947ad3453029da853432a0413dc93adb78ab88e4707e0802c8f2491a028" }, { "path": "apps/scan-cli/src/noise.ts", "sha256": "5d30d0453a93bd04a4bc10be6692d8a9813677dee35c7c3ba7af12ee7fb16bfa" }, { "path": "apps/scan-cli/src/oci.ts", "sha256": "c5600f5dbeb7e786ebcf0a75cf1d24c35314af3fcdcdc681feac7ad1154f7277" }, { "path": "apps/scan-cli/src/openapi.ts", "sha256": "6223b8611795454a8f0f52ec1f7bb577f19b144d41cb19dd226dc6c7168328c9" }, { "path": "apps/scan-cli/src/osdb.ts", "sha256": "cd464bb11b5953068934c17cde3f10bedaeaaed03fdf6d85cf267a2df0145e6b" }, { "path": "apps/scan-cli/src/prefilter.ts", "sha256": "53571e87886dbc160b0d64cac8a485c84d539c34e2a67bc07262350c2b83176f" }, { "path": "apps/scan-cli/src/prompts.ts", "sha256": "d5955b49d19e015c35afdd4fc46e69fa21f504230d285b65e6149d59cab53264" }, { "path": "apps/scan-cli/src/pullRequest.ts", "sha256": "2fbfa5525a0a9e9e0f9f35348429f397cc37bf22a897f779ea83e31a3d7c31bd" }, { "path": "apps/scan-cli/src/python-config.ts", "sha256": "cbd69945e59780938e88bbd3ba594696ad7c4fcfe00550e4a07102bd685e4065" }, { "path": "apps/scan-cli/src/python-flow.ts", "sha256": "ffc6d7325bbfefcc33b295998ee00ca3fb6fcf3af5df6391afff60a59ac34ade" }, { "path": "apps/scan-cli/src/quality.ts", "sha256": "7b69ff447ff7d673420eb84fc13c19b8b3a779f18bc01feb3c5c44166bcce40e" }, { "path": "apps/scan-cli/src/reachGraph.ts", "sha256": "099e451f8b1cf41d631d2831dba4629e4bc7ea0c31ce6b1291571e4f602dbd04" }, { "path": "apps/scan-cli/src/reachability.ts", "sha256": "fa01a82a0bca1a3ba67faca4f6fdc209fc0b81f099b59f70ead33dc6a1d5c24a" }, { "path": "apps/scan-cli/src/recovery.ts", "sha256": "c51f097dc8f7dfa1f0576c9c66fc459acb615122ad9e9d78b7ecad124b6c7e98" }, { "path": "apps/scan-cli/src/relatedSpans.ts", "sha256": "b455844c8a2dd2c8a91e56a291920ed34c7a3fb003c6cb285a82f2c5a92aaf2e" }, { "path": "apps/scan-cli/src/repoSecrets.ts", "sha256": "071dd5a1b259aa2cbf7adcd32b5a6010c69a8601711ae5a3f74117df35611d0f" }, { "path": "apps/scan-cli/src/reporter.ts", "sha256": "7c1ee9071898d0c47eb79c6542c7bd677933eda9f159f0dea9fcdcafc28bcbd6" }, { "path": "apps/scan-cli/src/repository-benchmark.ts", "sha256": "dc324cf0bf446082626a6bd31879782a6516149bd45d9293d7dbc519d7f08cb4" }, { "path": "apps/scan-cli/src/rule-defenses.ts", "sha256": "02e15e50eeefe594378f0cf7e9925d651df06561e64fe06365c7bcfdb3dcf1a1" }, { "path": "apps/scan-cli/src/rules.ts", "sha256": "4cd142f29398311478e0931f6f2cc0646d03d8f7448c423751927773996e4889" }, { "path": "apps/scan-cli/src/sbom.ts", "sha256": "2f76a139d11e49b67a826603881cbf81ffc4474bc4bd9fde6506e0c558c8f0d9" }, { "path": "apps/scan-cli/src/scan.ts", "sha256": "007d722679c2ad767b2cb643c2fadbb686ba1125e1e0e9fd667f5c481a9dff32" }, { "path": "apps/scan-cli/src/scanVersions.ts", "sha256": "5e3991039c32835b23767c90aafaa33ab15a6e61f7e01a9b0d3ab5683c602653" }, { "path": "apps/scan-cli/src/search.ts", "sha256": "f9db1c3b5fe9900a6e4f4335d53ada9083e2ae932ebcee853b56f527ba95f219" }, { "path": "apps/scan-cli/src/silence.ts", "sha256": "8c65ac7f0df90c9c15394ac6de861f86ce3d89a2930a8ebe7445d63eaa5e2787" }, { "path": "apps/scan-cli/src/spread.ts", "sha256": "2d80502b0d1b0d453aa0e2da7513fefdf75755a37d5af1e3cf6a5cb08b12d9d0" }, { "path": "apps/scan-cli/src/stability.ts", "sha256": "61012aae5957361f46a8f15413ea429e7350fefabce4e9e0e6fa972278cc34e7" }, { "path": "apps/scan-cli/src/stop.ts", "sha256": "d35e4491a63e6792342b8b5deea342a2b4bbe22975aeb6f26c51537e2275fd6f" }, { "path": "apps/scan-cli/src/sweep.ts", "sha256": "356678c7373530b517e05ab46e58d09df0eb7484a8bcca6f2b7b50a5753abc2b" }, { "path": "apps/scan-cli/src/tar.ts", "sha256": "2c80b52c78e9c75185ed90b3cd4f4a6bca969fe0d1c736f15f8b72e47773e6f6" }, { "path": "apps/scan-cli/src/template-flow.ts", "sha256": "435188aca557af792af85cb0553cac1361e075e2d3e007f8963b2e399810469b" }, { "path": "apps/scan-cli/src/tools.ts", "sha256": "cf9de13aa44e1550fdeedfba7e25ac7ccf36b289825a8eaf3f1928cf8b5df3d8" }, { "path": "apps/scan-cli/src/trivy.ts", "sha256": "150153c1b23996bc0f8a32301c65d0bff0be1fa2fae6cb7eb0f5c581c700c236" }, { "path": "apps/scan-cli/src/verdict-contract.ts", "sha256": "e24ab43d9f4cc96ebd2e3948286779b2e0b0390f42106f14b3b7eef3bcee9d61" }, { "path": "apps/scan-cli/src/verify.ts", "sha256": "a107310a1f21fff33e0642c492bd368858c4c46da73dedebfdf480f4931b8bfe" }, { "path": "apps/scan-cli/src/walk.ts", "sha256": "3d2a350dfe6e25403e50eefa3a0dbaebe275b422950717fc438be3bd5c74d097" }, { "path": "bun.lock", "sha256": "14b55bb0ae964bab83edb70d146e5e5eac16a7ef7418b4bd94842a5335edbbbd" }, { "path": "package.json", "sha256": "0c61121892bbd320487234c977f0e12f550a611adcb621d86d138c60cf0f6422" }, { "path": "packages/schemas/package.json", "sha256": "a46ecb31aa9aa33ceb6daafae8394ccdfa228fc7789198c421a02c0999aaa786" }, { "path": "packages/schemas/src/billing.ts", "sha256": "7ae419533da6bc2a20ad243b33b452dcd25d7dd67fe6c4b89c7d44193818322e" }, { "path": "packages/schemas/src/careers.ts", "sha256": "c367f27b05dfdc9d57e25fe9987bf21e78f3f65ea9556afccea999cbfc068c46" }, { "path": "packages/schemas/src/dependencyObservations.ts", "sha256": "d5a641b059b22592c692d3283502b9d77213ec42e77e03e600d0a20ee72d4038" }, { "path": "packages/schemas/src/findings.ts", "sha256": "a12c3448f1e41d2eda5313f9b9a8fcf64ed2b77ebc80e5e22a7c682060878a38" }, { "path": "packages/schemas/src/immunity.ts", "sha256": "cbe2557cc42d164e9d677f92ab8e26ce12762b4b2f60d5a3f2430b59a793abce" }, { "path": "packages/schemas/src/index.ts", "sha256": "dc8572d1089083d76301bdf8634bfe9565973f00e6cc49beca1101df17ec4cbe" }, { "path": "packages/schemas/src/investigation.ts", "sha256": "0a4a6a4370ff428910b2fb0ef53450fae064392dc58e341f8eb33da2252300b5" }, { "path": "packages/schemas/src/ir.ts", "sha256": "c1b1d0766b20e4830a9a6ab35d27ba16dc676f9a4c2a9badebd4fdbd17919df8" }, { "path": "packages/schemas/src/knowledge.ts", "sha256": "74488c0199366e71df6c2a83e71333317392e6b010e88f6beb66b935cec4bc85" }, { "path": "packages/schemas/src/notifications.ts", "sha256": "994d00573e810665c4379c2cb86147d28ac588ffca1b7f5c305cbd3ee98578c9" }, { "path": "packages/schemas/src/packages.ts", "sha256": "cabe240416e6c35be7baae9e776017e272f03efc5c4bcac3db05b3c11fa75d7e" }, { "path": "packages/schemas/src/proof.ts", "sha256": "80dcb156960b75ec0dee7e607fba08229ddc0cccb5c8951e813274b27340953f" }, { "path": "packages/schemas/src/reachability.ts", "sha256": "6f78887ccf9f09df85e9cad8b5c271fd036782846bcdd301de44e85645f86b39" }, { "path": "packages/schemas/src/reproduction.ts", "sha256": "ef08346d379d5f325bd579a7536679fef7d09fab7f4925392c55c55fd3aa7ab5" }, { "path": "packages/schemas/src/scanCompletion.ts", "sha256": "881dd9263b32be386c364e8595562cadf7e9cbda9efe5aa64abac11b798c7e8f" }, { "path": "packages/schemas/src/scanPullRequest.ts", "sha256": "09e56c5771b087884f735f69a3f3cb625f99e7aab1a867fd1f469fd1906ba2b6" }, { "path": "packages/schemas/src/scanReasons.ts", "sha256": "fba539e6d3c2140db2a329a6be9ce53e7ed0f6dc4437f085d2ce014be71d200a" }, { "path": "packages/schemas/src/secretRepair.ts", "sha256": "f139123f488ba9a19e2a22bcd02544986d0e056358876a3db51655f7d5a99be2" }, { "path": "packages/schemas/src/secrets.ts", "sha256": "e3a898bcadcbc68d0587b513db1d1945174437f358e0fe33624e97df50b42c00" }, { "path": "packages/schemas/src/security.ts", "sha256": "311afcee8ce9a869a622a19e2b1db1e57e003ace1f655921760ec21689a46f44" }, { "path": "packages/schemas/src/states.ts", "sha256": "540c39ae578d9f7cae4ab84e5e183852e6eb84ae49d1d992c2cbf8c2e81a66b6" }, { "path": "packages/schemas/src/wire.ts", "sha256": "b0c21292deadef07a17133b79eb89e4d3dc3dd6bfd165f61653efb699d9d6c3d" }, { "path": "packages/schemas/src/workspace.ts", "sha256": "17a5fab2b0f41f698fbe2f1eceb055c035ae04bec35f547c03531d2e0eefbf42" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/rule.yaml", "sha256": "add1d0987ffcb76cf8286d4da2210674893a8a8c693c9afacb5f4adbbfc7f73d" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/safe/sanitized_html.ts", "sha256": "0d602cd9ae708c8060652de16f1c361a5522dc81d81624e8bdaaaae2664457d2" }, { "path": "rulepacks/common/ANGULAR-TRUST-001/tests/vulnerable/bypass_trust_html.ts", "sha256": "dda816ef1b3d98aa23f109516466c901b66bee2cc3c4742f997ddbf75dac2165" }, { "path": "rulepacks/common/CLEARTEXT-001/rule.yaml", "sha256": "19d83cbe5fabd840248811236a6426d860695cc99d57105d7f67d71b46cfb809" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/safe/https_endpoint.ts", "sha256": "c497ad77c81fd53d387c2b5b10161388c87628740d0b678891581d330ab1ca03" }, { "path": "rulepacks/common/CLEARTEXT-001/tests/vulnerable/ftp_endpoint.ts", "sha256": "c3a6c3a828cc4cdca45bbdf486c6c2856066163884baa74f760a91e896f11870" }, { "path": "rulepacks/common/CMDI-001/rule.yaml", "sha256": "76a524d4596595bec3d2b8550e593f8f73b2c463c594bb7a70f2cb8c3ea9346c" }, { "path": "rulepacks/common/CODE-001/rule.yaml", "sha256": "313aa196ab864dd25536b018605c1c3b36f18956a367376ee0e005bb319f58be" }, { "path": "rulepacks/common/CODE-001/tests/safe/comment_mentions_eval.ts", "sha256": "a47f8173953238cb60d08856a1b037366fbe536a88da34b23c643e9cad35d572" }, { "path": "rulepacks/common/CODE-001/tests/safe/literal_mentions_eval.ts", "sha256": "3d09dab28d07ba35d263943091655822f5f5d217b2d6fccbbf3f9cb435bacfc2" }, { "path": "rulepacks/common/CODE-001/tests/vulnerable/eval_query.ts", "sha256": "e3f4f0d3c518040aa2696ea7f76ff19db67601d38be08b42373615b3ded3dae0" }, { "path": "rulepacks/common/DESER-001/rule.yaml", "sha256": "20b2f7b0d2b0a0dbf7d8725589a031e8d7cb58d318d151d099bfc1c2e484dd79" }, { "path": "rulepacks/common/DESER-001/tests/safe/yaml_safe_load.ts", "sha256": "7aaaf0beb687fdadfafbc7d6d1a952647353a222571032ea59242f87bf33dba9" }, { "path": "rulepacks/common/DESER-001/tests/vulnerable/yaml_load_body.ts", "sha256": "f108c65e1710a394fa1785691e1cb6d621e3e0b778da96403788137e3156453a" }, { "path": "rulepacks/common/PATH-001/rule.yaml", "sha256": "b45b1cfe6d8c5af96ec1e8a1c837feeb8ddc239424adca3c188a64c161a00d2f" }, { "path": "rulepacks/common/PATH-001/tests/safe/read_normalized_path.ts", "sha256": "de57b93ba7c7f086a1a9de7d2872628ccb63d84da3fb2fa1ef195bf58b0d2ca6" }, { "path": "rulepacks/common/PATH-001/tests/safe/template_allowlisted.ts", "sha256": "d1d539bba782f1be978bfc1758690d38426278adaf1a44dbf76705e47ce6618b" }, { "path": "rulepacks/common/PATH-001/tests/vulnerable/read_user_path.ts", "sha256": "f1b1f2b69e5992f4004d8a30d0e696fb19d21cd1cb02927e61687e5991d7569d" }, { "path": "rulepacks/common/REDIR-001/rule.yaml", "sha256": "ebaba25880fec0039dad28bd24cbdd36541ab08036ce72527d31363ba37551f7" }, { "path": "rulepacks/common/REDIR-001/tests/safe/redirect_allowlist.ts", "sha256": "903c9879c7b4b35624849633a17e8a34a86dc25f4526cc3df5342b5bb0e49bde" }, { "path": "rulepacks/common/REDIR-001/tests/vulnerable/open_redirect.ts", "sha256": "efd4e225c944fb8647054fa952e40f0d6f3b3b905e22a6bf89f4b2c310daf363" }, { "path": "rulepacks/common/SQLI-001/rule.yaml", "sha256": "3e64945a2e853ae7bbd868a110edbca234966a170a03f3dfe6f49de7077c6fcc" }, { "path": "rulepacks/common/SQLI-001/tests/safe/drizzle_where.ts", "sha256": "106f09d70c246f993c7098b5d059bea9b836d1d025154d2c21b2b330519e7ceb" }, { "path": "rulepacks/common/SQLI-001/tests/safe/identifier_allowlist.ts", "sha256": "bca1e858b9fda6aff77dc1334c96e61446966250ab503c5832c0ef2919ce8436" }, { "path": "rulepacks/common/SQLI-001/tests/safe/parameterized_query.ts", "sha256": "bc711ba097116beaedf72e93c7b3b20b961a2d1258948ecb0dbe6e0ab8831a4c" }, { "path": "rulepacks/common/SQLI-001/tests/vulnerable/concat_query.ts", "sha256": "a2429d8b1f611d41495a356ac305368dc5b78092e491a43bedf6a0f663b6ecb8" }, { "path": "rulepacks/common/SSRF-001/rule.yaml", "sha256": "86bbbbd1f8bfe819cb8af8bde8ca5e43e038979c728fa8ad030641777a631f3e" }, { "path": "rulepacks/common/SSRF-001/tests/safe/express_proxy_allowlist.ts", "sha256": "571f26fc750cdb14b72c7803cd2dd50d62acd806d1677dd5165aa92060ecd21f" }, { "path": "rulepacks/common/SSRF-001/tests/vulnerable/express_proxy.ts", "sha256": "e4f646374bcb08c30fb8af627a91668f4841512cebe1bf804f79c0c4cc2229ab" }, { "path": "rulepacks/common/SSTI-001/rule.yaml", "sha256": "1cf2a5878dad69f9adf9cad88ea2000064898a51447e053a47ef05581954edde" }, { "path": "rulepacks/common/SSTI-001/tests/safe/precompiled_template.ts", "sha256": "0d5febf5ff8f2070115eaeba0870cdfcd392a2dd142487f0a996b04cc491a6e1" }, { "path": "rulepacks/common/SSTI-001/tests/vulnerable/handlebars_compile.ts", "sha256": "4b04998aa32236b06404c7c9aaf2674d01173576b2401efd4904166a4f30fd5f" }, { "path": "rulepacks/common/UPLOAD-001/rule.yaml", "sha256": "e5d8812fab296e63bb94fed6486797995e830fd2feedb5e4ac567bb7e904600b" }, { "path": "rulepacks/common/UPLOAD-001/tests/safe/mime_checked_upload.ts", "sha256": "e020db518e233ac8433f5237c1744d70d6854bd802dbd232f6377d1e03c9aa77" }, { "path": "rulepacks/common/UPLOAD-001/tests/vulnerable/unchecked_upload.ts", "sha256": "c2c4629e3af2db831f72d99572b49c758174bb224e4a2f4abb88ab82f12a3967" }, { "path": "rulepacks/common/XSS-001/rule.yaml", "sha256": "4eafa1e0a5329f76ec075e03d6bf756570cd1643ec4b1aaff9f4ae8960073237" }, { "path": "rulepacks/common/XSS-001/tests/safe/escaped_html.ts", "sha256": "199162c065905fc36a12bae5eedef52093de52b6faea7189b26c94fc4b297fd0" }, { "path": "rulepacks/common/XSS-001/tests/vulnerable/inner_html.ts", "sha256": "9bc3e7f70495dec60e4fae6e44c6525d1f7eed9eaab34f1b7f0c2f62ee334865" }, { "path": "rulepacks/javascript/CMDI-002/rule.yaml", "sha256": "ec140652bbbf75b9ac7abf0491617a7b2fedafec6b01e061afcc455fd46dfab2" }, { "path": "rulepacks/javascript/CODE-002/rule.yaml", "sha256": "5fba2995a7c08491b7fce10659cff11e00d9197bf59a5d3a38f93403ca398b63" }, { "path": "rulepacks/javascript/PATH-002/rule.yaml", "sha256": "6cd1dcc2bd021b507e56eda1048e2d556a7f2d63e174a387c55654dfd32b2fc1" }, { "path": "rulepacks/javascript/PROTO-001/rule.yaml", "sha256": "bf376e71fc05a878df13da0e52dad459fb0c3fd64022d8a69733f3714f6c0ee7" }, { "path": "rulepacks/javascript/PROTO-002/rule.yaml", "sha256": "a33eb6189979feb4815736b9b41878181409cb6582bcbc84cf8b570a8ca6fdde" }, { "path": "rulepacks/javascript/REDOS-001/rule.yaml", "sha256": "b20709f91bfe5bc2b834174a53fb2d0aa2772fd21838191273c117a662d7fbbc" }, { "path": "rulepacks/javascript/REDOS-002/rule.yaml", "sha256": "96c5b0ca1b87ccfd62d47a5cdf0333b9aeb8af676e57db2cb1bf51071a01f128" }, { "path": "rulepacks/javascript/REDOS-003/rule.yaml", "sha256": "1cc53d782185aed8c25f674342c6e25c26bf4fe7d28c11149cd7d4e6c00591b1" }, { "path": "rulepacks/javascript/REDOS-004/rule.yaml", "sha256": "4fc5fa489991681c7b6c7c8fdab2271f0e482c5bdf65cbdb1a5ed14fcc79fefa" }, { "path": "rulepacks/javascript/XSS-002/rule.yaml", "sha256": "265b5dddc5503e3cfede82589a20346e7111aee234aae699bd72010284ab4819" }, { "path": "rulepacks/python/COOKIE-001/rule.yaml", "sha256": "e96b7b90b587fa6d110a094a04a62e892ea7c3e568dc3348cb91152dc31b28eb" }, { "path": "rulepacks/python/DESER-002/rule.yaml", "sha256": "a77cd0730f50c608ddaa4d8446adb7b728522990b1cd772a96648113e522c731" }, { "path": "rulepacks/python/HASH-001/rule.yaml", "sha256": "e73bc710813e3432d33ebd5c3009af465ff431828a6f62023f8134284cb2952c" }, { "path": "rulepacks/python/LDAP-001/rule.yaml", "sha256": "ba5af874b16aced31442688c2696bdce5d653e06777cb8405ba4827fe81299d9" }, { "path": "rulepacks/python/PYEXEC-001/rule.yaml", "sha256": "e894bf53024edc28c99465d76e0ba6cf0041a365c3e47d886f8fa2d4bb9d978f" }, { "path": "rulepacks/python/RANDOM-001/rule.yaml", "sha256": "cc5ef82221e457cd3735ddf1a2460f0ad1b4c0a42d8d046dc6eb8826c8a4401e" }, { "path": "rulepacks/python/SQLI-002/rule.yaml", "sha256": "8870d9e0c8e50ef1e98bdd0a5d340a993fd08bb79c99b83ab0d5d428532efd3c" }, { "path": "rulepacks/python/SSTI-002/rule.yaml", "sha256": "9eaef2a4dd0a2a05427b38d57224363493ae4d6084de444cb972abe363b4a7e5" }, { "path": "rulepacks/python/TRUST-001/rule.yaml", "sha256": "951696eaf7ece7422b37a1fa86d5985f8d3b128d583ce50df98520a877896372" }, { "path": "rulepacks/python/XPATH-001/rule.yaml", "sha256": "17604e33d66d6d7e378932a5979beba8bd09166a0c9bb9fe298cd448ba34d43b" }, { "path": "rulepacks/python/XXE-001/rule.yaml", "sha256": "560eadedab50b15f003f19895559b947ef17958200940ab1099a351b3278bc4d" } ], "selection": { "seed": "cefense-model-followup-untouched-2026-10-22:", "procedure": "Exclude all 28 earlier model-pilot case IDs. Partition the remaining 1202 author-labelled cases by exact expected CWE and vulnerable boolean. Select the minimum SHA-256(seed + original case ID) in each of 28 strata. No detector/model predictions used for selection or anchor review. Case source was inspected by the publication evaluator before new predictions; selected source and findings were not supplied to detector/prompt implementers. The public suite labels and deterministic corpus are already familiar from earlier work, so this is an untouched model-evaluation cohort, not an independent repository holdout.", "selectedCases": 28, "corpusCases": 1230, "unselectedCases": 1202, "caseManifestSha256": "656966c8c77db51cc59de35953498b04660f50cf9eba82e87794b380336e3c98", "caseIds": [ "BenchmarkTest01109", "BenchmarkTest00619", "BenchmarkTest01173", "BenchmarkTest00168", "BenchmarkTest00670", "BenchmarkTest00096", "BenchmarkTest00192", "BenchmarkTest00455", "BenchmarkTest00732", "BenchmarkTest00265", "BenchmarkTest00426", "BenchmarkTest00422", "BenchmarkTest00148", "BenchmarkTest01077", "BenchmarkTest01058", "BenchmarkTest00621", "BenchmarkTest00071", "BenchmarkTest00072", "BenchmarkTest00513", "BenchmarkTest00510", "BenchmarkTest00151", "BenchmarkTest01178", "BenchmarkTest00540", "BenchmarkTest00294", "BenchmarkTest01090", "BenchmarkTest00064", "BenchmarkTest00938", "BenchmarkTest00101" ], "sinkReview": "Read all selected post handlers before any new model predictions. Fixed anchors identify filesystem access, command execution, returned HTML assembly/return, SQL/LDAP/XPath execution, eval/exec, digest creation, security random generation, session mutation, deserialization, redirect, XML parser configuration/parse, or cookie configuration. Expected author labels are retained without adjudication. No score-dependent edits are permitted." }, "plan": { "mode": "default", "maxRounds": 1, "sweepEffort": "none", "verifyEffort": "low", "verifyEnabled": true, "minConfidence": 0.4, "absenceLane": true, "spread": false, "secondOpinion": false, "verifyEngineFindings": false }, "limits": { "requests": 80, "tokens": 600000, "dollars": 0.48 }, "scope": "Production detection-stage prompt, snippet mapping gates, configured verification and native union policy. Selected source files only, with imported helper bodies absent. No intelligence retrieval, repository execution, additional sweep/absence/spread/chain lanes, PR generation or full hosted scan. Public label-known corpus, not independent held-out accuracy. Labels and suite identifiers are not model messages. Native findings are never deleted by model review.", "targetPlatform": "unknown", "prices": { "inputUsdPerMillion": 0.3, "outputUsdPerMillion": 1.2, "source": "https://api-docs.deepseek.com/quick_start/pricing/", "checkedAt": "2026-10-22T09:14:15.981Z" }, "planned": 28, "corpusCases": 1230, "unselectedCases": 1202, "scores": { "nativeDeterministic": { "tp": 14, "fn": 0, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyMapped": { "tp": 12, "fn": 2, "fp": 6, "tn": 8, "scored": 28, "failed": 0, "notRun": 0 }, "modelOnlyVerified": { "tp": 12, "fn": 2, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 }, "servedCombined": { "tp": 14, "fn": 0, "fp": 2, "tn": 12, "scored": 28, "failed": 0, "notRun": 0 } }, "cases": [ { "id": "BenchmarkTest01109", "path": "testcode/BenchmarkTest01109.py", "expectedCwe": "CWE-22", "vulnerable": false, "sinkLines": [ 48 ], "sourceSha256": "50a81744784ae345fe5e185d4e1e0dcd5f2cd1027da685ab9d0b3587435a90ec", "sanitizedSha256": "046673552639bdde0bf53e8bf86952e13b2667a715d66ea6409d119b3962cbef", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00619", "path": "testcode/BenchmarkTest00619.py", "expectedCwe": "CWE-22", "vulnerable": true, "sinkLines": [ 53 ], "sourceSha256": "f8c5d506c626838763e389f6fa73422253269ab82b99d971f2b8c43d73f5fd57", "sanitizedSha256": "67f819a161c0e145282e786eb30198a3e924f225d9ff64e45803ca59169f76eb", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest01173", "path": "testcode/BenchmarkTest01173.py", "expectedCwe": "CWE-78", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "cab02e797999547489e145d4fed01cffa2d1e6b7b966868223b2cb2ab486e74b", "sanitizedSha256": "eacf51696eae21531a939ad5f9a2a9b627ecaec0469f3ad2d76dad02f645b3c8", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00168", "path": "testcode/BenchmarkTest00168.py", "expectedCwe": "CWE-78", "vulnerable": true, "sinkLines": [ 60 ], "sourceSha256": "4ac770cd0c09bb7f0836026f44bfbef036d499eead2925ef195824e2605df169", "sanitizedSha256": "c8fb517b9a6bb4a693b1674b12a5c61f28413025f98b182a7cf8136d594659a4", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00670", "path": "testcode/BenchmarkTest00670.py", "expectedCwe": "CWE-79", "vulnerable": false, "sinkLines": [ 45, 46, 47, 49 ], "sourceSha256": "cf0ffbf2521ef3b2bd5f113f78c6544b99d594f25c581361f2fd0c625b6d1a01", "sanitizedSha256": "ebab115c9670aa850d94e02aa3f48153c2519241ebd4e09f95bd8848b3d1b00e", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00096", "path": "testcode/BenchmarkTest00096.py", "expectedCwe": "CWE-79", "vulnerable": true, "sinkLines": [ 50, 51, 52, 54 ], "sourceSha256": "c8448b0fd2b31f66cdd269bf17a5064dbddbdef90586392d2d7ee5114d5cfda0", "sanitizedSha256": "f79965eedba0109ab2d2c1d864d591189e31f694e9dbc93aec5758536bd0628d", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00192", "path": "testcode/BenchmarkTest00192.py", "expectedCwe": "CWE-89", "vulnerable": false, "sinkLines": [ 54 ], "sourceSha256": "3b5fc1f1625dcde200acf3c2933dac865dae84477d06ba789c6b5d7c43edfd47", "sanitizedSha256": "38462c35a4a0d0f262b93859f040d30e0f7d710f755f3184d3a1357cee76b31a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00455", "path": "testcode/BenchmarkTest00455.py", "expectedCwe": "CWE-89", "vulnerable": true, "sinkLines": [ 46 ], "sourceSha256": "dd5e271f9ac139e7ac99bbde78145027d789ae63357bbcdc5dd5c1987b050eeb", "sanitizedSha256": "36d943d736cb92663752fd39d3926979295582a337e6be348ac58fce6babde02", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00732", "path": "testcode/BenchmarkTest00732.py", "expectedCwe": "CWE-90", "vulnerable": false, "sinkLines": [ 46 ], "sourceSha256": "b9669a1638c1ed6b9979107ef0957ecbecd8190ee2fdfa113d9fec7fea382eb3", "sanitizedSha256": "e8a282f519d51a0aa41999921519fe4ae472fb0bce5a872f026521cd2284333a", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00265", "path": "testcode/BenchmarkTest00265.py", "expectedCwe": "CWE-90", "vulnerable": true, "sinkLines": [ 45 ], "sourceSha256": "ae83fc0686dab7903e2b82a58d9c4ef1839bb6040d7374e77ddfc74e49816220", "sanitizedSha256": "f60121cb218d881d9099de6753c17bef45702753a8bbe2085589f14ed6f4204b", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00426", "path": "testcode/BenchmarkTest00426.py", "expectedCwe": "CWE-94", "vulnerable": false, "sinkLines": [ 57 ], "sourceSha256": "ad6a8e062b226c80882e82f29a128699297e5999db7ba3c6f6bbd4d02419f9e4", "sanitizedSha256": "04938f1e0fa60b8c26aa575555da09ad62c12dff22d1a8575aef0c81d279b2af", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest00422", "path": "testcode/BenchmarkTest00422.py", "expectedCwe": "CWE-94", "vulnerable": true, "sinkLines": [ 44 ], "sourceSha256": "e16bed57525e8e1b27cd724cedac15deb040dca744d702b92b109192ba2b9a5c", "sanitizedSha256": "e8072cd7128d07555fade12edc887e40db03b4abf61a3eb98c0da4b9bf2c880c", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 3 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00148", "path": "testcode/BenchmarkTest00148.py", "expectedCwe": "CWE-328", "vulnerable": false, "sinkLines": [ 54, 55 ], "sourceSha256": "fa5627181ac92dcd326cb2f17f480b1a1ad228dfb19aa38da3c506686bcb3975", "sanitizedSha256": "b1fcd9472db207173ecd283451f518ac548363c855f7d112b4b67a2688f06853", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 1 } } }, { "id": "BenchmarkTest01077", "path": "testcode/BenchmarkTest01077.py", "expectedCwe": "CWE-328", "vulnerable": true, "sinkLines": [ 55, 56 ], "sourceSha256": "41918ac52be77f9e807a22683317ff2c21f732ec5dff46b6f76423aaf3fe7270", "sanitizedSha256": "2f5436834930f39a1224ff900ff57f7f5b4b0685940a168cad6bf16788e51abd", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest01058", "path": "testcode/BenchmarkTest01058.py", "expectedCwe": "CWE-330", "vulnerable": false, "sinkLines": [ 52 ], "sourceSha256": "04f37ba243af0fe6a38364ed929f6c95b04ebfc5c993642b65e0ac3e863f0b06", "sanitizedSha256": "1a1f4bf5ea4db125900b5f2b9fa939854e76ef02491c8a8085a2aeeb613e3072", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00621", "path": "testcode/BenchmarkTest00621.py", "expectedCwe": "CWE-330", "vulnerable": true, "sinkLines": [ 52 ], "sourceSha256": "6a292714b56b785093546524b39d419e4695f31f2a58cb0d022673a76c1c190b", "sanitizedSha256": "44aedc0c7420b2b240282101b475e18221dee1ff5b6e4b3066a161e376250ea2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 1 } } }, { "id": "BenchmarkTest00071", "path": "testcode/BenchmarkTest00071.py", "expectedCwe": "CWE-501", "vulnerable": false, "sinkLines": [ 51 ], "sourceSha256": "02b9ce18abba8a2b4368f21a81c14fb0749cc2cb59106ca0c478b141652e4a44", "sanitizedSha256": "c08103e650acda7a6a6cee7c157d5dcacab86234ef8a4f63b31ca1eadc718460", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00072", "path": "testcode/BenchmarkTest00072.py", "expectedCwe": "CWE-501", "vulnerable": true, "sinkLines": [ 49 ], "sourceSha256": "d467a06b2d69eed8621effc25f1598cf9a8d65b62a174ab8b26110a80ed77ca4", "sanitizedSha256": "4866259f8a004f13bbf018f59df1d7037a779e3a0f4a7da3fd3d4eee7d50fe48", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00513", "path": "testcode/BenchmarkTest00513.py", "expectedCwe": "CWE-502", "vulnerable": false, "sinkLines": [ 45 ], "sourceSha256": "85a879ec61190b92afe6cddbf3fcddad16954677e81c6160680d019a0345a0b2", "sanitizedSha256": "fdbafaf1106aecfe62334f55ac9fadf40cd47e1e5df279b33da95d5eeb75e5b9", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00510", "path": "testcode/BenchmarkTest00510.py", "expectedCwe": "CWE-502", "vulnerable": true, "sinkLines": [ 46 ], "sourceSha256": "4d418ee88e8efce4f63a732172b23d25406b3bebc1243546a688425ab0493afc", "sanitizedSha256": "e53c02f33b16c10d6d293ce28e0fa3722833f72673041624f4a5272d93215849", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00151", "path": "testcode/BenchmarkTest00151.py", "expectedCwe": "CWE-601", "vulnerable": false, "sinkLines": [ 64 ], "sourceSha256": "a00089f0f8902a15c60e8ff1d800dde791fa5eae3779edf1230c307b935fb6d1", "sanitizedSha256": "c213ef4829bebe86a09805ae5e82f03b75b73bf14eec56434ab414062d34eb82", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest01178", "path": "testcode/BenchmarkTest01178.py", "expectedCwe": "CWE-601", "vulnerable": true, "sinkLines": [ 44 ], "sourceSha256": "fe44ffc9a12d6282ca2cdec4dd0cc495a36545e70856fbc7c90ea0cec5804f75", "sanitizedSha256": "c6b1c9d5bd211b5eccb32a522b459cbdc66689932d866f32135897b883e2b6e2", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest00540", "path": "testcode/BenchmarkTest00540.py", "expectedCwe": "CWE-611", "vulnerable": false, "sinkLines": [ 56, 58 ], "sourceSha256": "d29f94759ef5bd84b34b4f8cae70468011a3d06dc4cf57f116f0f5e577bbdb49", "sanitizedSha256": "de5829864087e3898e2180e9f2c96ef983bebcee31513c9fa30dd7b0140daa87", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00294", "path": "testcode/BenchmarkTest00294.py", "expectedCwe": "CWE-611", "vulnerable": true, "sinkLines": [ 50, 52 ], "sourceSha256": "08350a96a5aa9a27f69573bb85f3f01265b0eae4d8ddb483409b7b82eb77581a", "sanitizedSha256": "e8d958ea10c17f00706aa528068b1cfcdd23929d07ebb1d65bf5260f3111e8f0", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } }, { "id": "BenchmarkTest01090", "path": "testcode/BenchmarkTest01090.py", "expectedCwe": "CWE-614", "vulnerable": false, "sinkLines": [ 62, 63, 64, 65 ], "sourceSha256": "2190d04cd05886ecc73a95e1b2075ee64a148e89650e5d96aadcefe438dac8f7", "sanitizedSha256": "a89baa183925d709aed4525c5a10dd566921353b0614a32a61a101920b825685", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00064", "path": "testcode/BenchmarkTest00064.py", "expectedCwe": "CWE-614", "vulnerable": true, "sinkLines": [ 62, 63, 64, 65 ], "sourceSha256": "8ab91066d9084888be73afd6390d257d358b606cc8de482486587686be44cdb9", "sanitizedSha256": "40c7b4b17d61d313cbc45162ccaf8f453836c7dec3472abd11f0fc2e6fde7913", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 3 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 3 } } }, { "id": "BenchmarkTest00938", "path": "testcode/BenchmarkTest00938.py", "expectedCwe": "CWE-643", "vulnerable": false, "sinkLines": [ 60 ], "sourceSha256": "9eb6748e839453b9ee9055d4dd41b562df1ede48844c094f0e5c1155a199f304", "sanitizedSha256": "6a0e0a61338b3685fe8654236c4b9c4c15c4586985fba325733955f8d4fd9c4f", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyMapped": { "status": "complete", "detected": false, "findingCount": 0 }, "modelOnlyVerified": { "status": "complete", "detected": false, "findingCount": 0 }, "servedCombined": { "status": "complete", "detected": false, "findingCount": 0 } } }, { "id": "BenchmarkTest00101", "path": "testcode/BenchmarkTest00101.py", "expectedCwe": "CWE-643", "vulnerable": true, "sinkLines": [ 55 ], "sourceSha256": "8a8ba79ecfe9ad2db71b07abfd24563a6f5e422f00490b2f210868e4b012d6c6", "sanitizedSha256": "b3b990dff7476ecb5323fb551bde76a2c547e533e27c0bc390bd6c94677c1aca", "outcomes": { "nativeDeterministic": { "status": "complete", "detected": true, "findingCount": 2 }, "modelOnlyMapped": { "status": "complete", "detected": true, "findingCount": 1 }, "modelOnlyVerified": { "status": "complete", "detected": true, "findingCount": 1 }, "servedCombined": { "status": "complete", "detected": true, "findingCount": 2 } } } ], "servedCombinedPolicy": "Native deterministic findings are preserved and unioned with production-verified model findings using filterNovel. Model failures do not remove native positives and are not scored as safe negatives.", "usage": { "requests": 22, "tokens": 86250, "dollars": 0.06110639999999999, "costUsdUpperBound": 0.06110639999999999, "measuredPromptTokens": 47104, "measuredCompletionTokens": 39146, "unknownUsageRequests": 0, "latencyMs": 196124.43245699996, "accountingPolicy": "Configured peak cache-miss input and output upper bounds. Completion tokens include provider thinking tokens; cached-input discounts are not credited. Missing usage or interrupted attempts retain full reservation. Actual account billing is not independently verified." }, "providerModels": [ "deepseek-flash" ], "requests": [ { "requestSha256": "5edc1f9898babceeebf0cf06692a485d00f30eeb2807051111dc39e1a7f9b4ac", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:17:45.397Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 18280.917458, "promptTokens": 13494, "completionTokens": 4750 }, { "requestSha256": "114da9be500caaad0e9049eb5a90114eeecf55212a103c5eda6c49fa10c10e67", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:03.694Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3616.845000000001, "promptTokens": 1594, "completionTokens": 511, "reasoningTokens": 351 }, { "requestSha256": "d8f3c4d58c0483f6fa12ce07712d7cafc3b655dd255ea89c6e4fbb5702175898", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:07.820Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 16985.465, "promptTokens": 1606, "completionTokens": 3126, "reasoningTokens": 2942 }, { "requestSha256": "548903ace37bddba6f273ab9f2aad4a76af4d3f9ee055f488c6ecaa5702b3f13", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:24.886Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5043.822166999998, "promptTokens": 1580, "completionTokens": 743, "reasoningTokens": 594 }, { "requestSha256": "139a557db18165809b6338e17ab596709be6845539ff00decbc0f2dfa84bf115", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:29.934Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 7530.311791, "promptTokens": 1486, "completionTokens": 1503, "reasoningTokens": 1340 }, { "requestSha256": "447a02836ed5033945f5aaa4d99a7c6873ef6c013d773f501c34f514b965e94c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:37.560Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2318.3383749999994, "promptTokens": 1672, "completionTokens": 265, "reasoningTokens": 118 }, { "requestSha256": "5d203426e80300252f5203b41e3e8af8a2dd2d19770ae0d5c63333c3ced9cfe1", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:40.291Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 19419.451374999997, "promptTokens": 1619, "completionTokens": 3832, "reasoningTokens": 3634 }, { "requestSha256": "63b04256d95cd294363e1f293fcdd3a3f4a3904a3ce774681afec50dabb1a875", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:18:59.715Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2045.309957999998, "promptTokens": 1675, "completionTokens": 265, "reasoningTokens": 94 }, { "requestSha256": "841c61053373af2060804a40fc70ee00aaa65df57c1dc43ce71bcff98881b26f", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:19:01.765Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 5461.214957999997, "promptTokens": 1607, "completionTokens": 1017, "reasoningTokens": 830 }, { "requestSha256": "8d5b691ad014ca487453882116b63f848e6e42fbe3fbe7334820636aa3c3a16a", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:19:07.245Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 50178.2715, "promptTokens": 1697, "completionTokens": 10861, "reasoningTokens": 10644 }, { "requestSha256": "45b74a39d7587331777905225dafc82ca28a4e344e9dc3a3676e4b7ce53e5a28", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:19:57.429Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3190.923791999987, "promptTokens": 1559, "completionTokens": 552, "reasoningTokens": 376 }, { "requestSha256": "d80ebce919d4b05c78d489effc5897fbe25171793524dd4fd646346449df18da", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:00.719Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3482.5326250000217, "promptTokens": 1602, "completionTokens": 591, "reasoningTokens": 373 }, { "requestSha256": "cfc02bbc7934d616966fc4d20d388abf959752ce1ae042c96c70b8f05602cf23", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:04.355Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 4737.34358299998, "promptTokens": 1543, "completionTokens": 965, "reasoningTokens": 779 }, { "requestSha256": "994ff911d38dc2fb7a6d738c898d4e2136f4c3d9fa43a831fb4d29914c3892c8", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:09.218Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6004.131583999988, "promptTokens": 1571, "completionTokens": 1115, "reasoningTokens": 959 }, { "requestSha256": "7e4cf256f5fccdc4e2ebb0ad442387e3246da35ed386544278659ca4b50c9dd1", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:15.227Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 9838.867666000006, "promptTokens": 1564, "completionTokens": 1893, "reasoningTokens": 1740 }, { "requestSha256": "a7010f1d6a25f18f8ec0ecd60aee44ec62a6eef66b55aee66b9adfe1a7656e2c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:25.091Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6220.775416999997, "promptTokens": 1658, "completionTokens": 1165, "reasoningTokens": 970 }, { "requestSha256": "4b8061d676f87f6e4b960abc5f0560c023aff725fb17ad136a22bab9c7ea13ee", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:31.321Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2295.700125000003, "promptTokens": 1523, "completionTokens": 336, "reasoningTokens": 174 }, { "requestSha256": "53b371347d0801ce9bfa7e85639989acc5e63e13bcd92a0a0d9e76a14efedf98", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:33.624Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 10878.105290999985, "promptTokens": 1567, "completionTokens": 2054, "reasoningTokens": 1858 }, { "requestSha256": "577f42bdddc3ad814a7d5b13eb72d976ee859acc48a7480c7b3a9a0998748595", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:44.508Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 2735.548167000001, "promptTokens": 1721, "completionTokens": 436, "reasoningTokens": 279 }, { "requestSha256": "0f1cfd93c66f33da541ba1156302f9c5308679cb7135e5098a0a1018eed39656", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:47.248Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6311.971374999994, "promptTokens": 1566, "completionTokens": 1236, "reasoningTokens": 1065 }, { "requestSha256": "a277e9dd67e4bce2283af157cb83faf5bb08535b27aa9b8fdb85c328a5e3ec2c", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:53.574Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 6172.535499999998, "promptTokens": 1497, "completionTokens": 1423, "reasoningTokens": 1234 }, { "requestSha256": "00ba3025f1d5e13c16adda33008891f19d1618a7b86e9e3a43ed14bd23ab761f", "accounting": "provider_usage", "failed": false, "startedAt": "2026-10-22T09:20:59.754Z", "providerModel": "deepseek-flash", "status": 200, "latencyMs": 3376.0497500000056, "promptTokens": 1703, "completionTokens": 507, "reasoningTokens": 346 } ], "diagnostics": { "BenchmarkTest01109": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 48, "endLine": 48 }, { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 47, "endLine": 48 } ], "modelOnlyVerified": [ { "cwe": "CWE-22", "startLine": 47, "endLine": 48 } ], "servedCombined": [ { "cwe": "CWE-22", "startLine": 48, "endLine": 48 }, { "cwe": "CWE-79", "startLine": 53, "endLine": 53 } ] }, "BenchmarkTest00619": { "nativeDeterministic": [ { "cwe": "CWE-22", "startLine": 53, "endLine": 53 }, { "cwe": "CWE-79", "startLine": 64, "endLine": 64 } ], "modelOnlyMapped": [ { "cwe": "CWE-22", "startLine": 52, "endLine": 53 } ], "modelOnlyVerified": [ { "cwe": "CWE-22", "startLine": 52, "endLine": 53 } ], "servedCombined": [ { "cwe": "CWE-22", "startLine": 53, "endLine": 53 }, { "cwe": "CWE-79", "startLine": 64, "endLine": 64 } ] }, "BenchmarkTest01173": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 51, "endLine": 51 }, { "cwe": "CWE-79", "startLine": 61, "endLine": 61 } ], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 48, "endLine": 51 } ], "modelOnlyVerified": [ { "cwe": "CWE-78", "startLine": 48, "endLine": 51 } ], "servedCombined": [ { "cwe": "CWE-78", "startLine": 51, "endLine": 51 }, { "cwe": "CWE-79", "startLine": 61, "endLine": 61 } ] }, "BenchmarkTest00168": { "nativeDeterministic": [ { "cwe": "CWE-78", "startLine": 60, "endLine": 60 }, { "cwe": "CWE-79", "startLine": 70, "endLine": 70 } ], "modelOnlyMapped": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 60 } ], "modelOnlyVerified": [ { "cwe": "CWE-78", "startLine": 57, "endLine": 60 } ], "servedCombined": [ { "cwe": "CWE-78", "startLine": 60, "endLine": 60 }, { "cwe": "CWE-79", "startLine": 70, "endLine": 70 } ] }, "BenchmarkTest00670": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 45, "endLine": 47 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00096": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 54, "endLine": 54 } ], "modelOnlyMapped": [ { "cwe": "CWE-79", "startLine": 50, "endLine": 52 } ], "modelOnlyVerified": [ { "cwe": "CWE-79", "startLine": 50, "endLine": 52 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 54, "endLine": 54 } ] }, "BenchmarkTest00192": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00455": { "nativeDeterministic": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-79", "startLine": 52, "endLine": 52 } ], "modelOnlyMapped": [ { "cwe": "CWE-89", "startLine": 43, "endLine": 46 } ], "modelOnlyVerified": [ { "cwe": "CWE-89", "startLine": 43, "endLine": 46 } ], "servedCombined": [ { "cwe": "CWE-89", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-79", "startLine": 52, "endLine": 52 } ] }, "BenchmarkTest00732": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00265": { "nativeDeterministic": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 45 } ], "modelOnlyVerified": [ { "cwe": "CWE-90", "startLine": 42, "endLine": 45 } ], "servedCombined": [ { "cwe": "CWE-90", "startLine": 45, "endLine": 45 }, { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ] }, "BenchmarkTest00426": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ], "modelOnlyMapped": [ { "cwe": "CWE-94", "startLine": 56, "endLine": 57 } ], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 63, "endLine": 63 } ] }, "BenchmarkTest00422": { "nativeDeterministic": [ { "cwe": "CWE-94", "startLine": 44, "endLine": 44 }, { "cwe": "CWE-95", "startLine": 44, "endLine": 44 }, { "cwe": "CWE-79", "startLine": 51, "endLine": 51 } ], "modelOnlyMapped": [ { "cwe": "CWE-95", "startLine": 42, "endLine": 45 } ], "modelOnlyVerified": [ { "cwe": "CWE-95", "startLine": 42, "endLine": 45 } ], "servedCombined": [ { "cwe": "CWE-94", "startLine": 44, "endLine": 44 }, { "cwe": "CWE-95", "startLine": 44, "endLine": 44 }, { "cwe": "CWE-79", "startLine": 51, "endLine": 51 } ] }, "BenchmarkTest00148": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [ { "cwe": "CWE-79", "startLine": 65, "endLine": 65 } ] }, "BenchmarkTest01077": { "nativeDeterministic": [ { "cwe": "CWE-328", "startLine": 55, "endLine": 55 } ], "modelOnlyMapped": [ { "cwe": "CWE-328", "startLine": 55, "endLine": 56 } ], "modelOnlyVerified": [ { "cwe": "CWE-328", "startLine": 55, "endLine": 56 } ], "servedCombined": [ { "cwe": "CWE-328", "startLine": 55, "endLine": 55 } ] }, "BenchmarkTest01058": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00621": { "nativeDeterministic": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ], "modelOnlyMapped": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ], "modelOnlyVerified": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ], "servedCombined": [ { "cwe": "CWE-330", "startLine": 52, "endLine": 52 } ] }, "BenchmarkTest00071": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-915", "startLine": 51, "endLine": 51 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00072": { "nativeDeterministic": [ { "cwe": "CWE-501", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 56, "endLine": 56 } ], "modelOnlyMapped": [ { "cwe": "CWE-915", "startLine": 49, "endLine": 49 } ], "modelOnlyVerified": [ { "cwe": "CWE-915", "startLine": 49, "endLine": 49 } ], "servedCombined": [ { "cwe": "CWE-501", "startLine": 49, "endLine": 49 }, { "cwe": "CWE-79", "startLine": 56, "endLine": 56 }, { "cwe": "CWE-915", "startLine": 49, "endLine": 49 } ] }, "BenchmarkTest00513": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-502", "startLine": 45, "endLine": 45 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00510": { "nativeDeterministic": [ { "cwe": "CWE-502", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-502", "startLine": 46, "endLine": 46 } ], "modelOnlyMapped": [ { "cwe": "CWE-502", "startLine": 46, "endLine": 46 } ], "modelOnlyVerified": [ { "cwe": "CWE-502", "startLine": 46, "endLine": 46 } ], "servedCombined": [ { "cwe": "CWE-502", "startLine": 46, "endLine": 46 }, { "cwe": "CWE-502", "startLine": 46, "endLine": 46 } ] }, "BenchmarkTest00151": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest01178": { "nativeDeterministic": [ { "cwe": "CWE-601", "startLine": 44, "endLine": 44 }, { "cwe": "CWE-79", "startLine": 44, "endLine": 44 } ], "modelOnlyMapped": [ { "cwe": "CWE-601", "startLine": 39, "endLine": 44 } ], "modelOnlyVerified": [ { "cwe": "CWE-601", "startLine": 39, "endLine": 44 } ], "servedCombined": [ { "cwe": "CWE-601", "startLine": 44, "endLine": 44 }, { "cwe": "CWE-79", "startLine": 44, "endLine": 44 } ] }, "BenchmarkTest00540": { "nativeDeterministic": [], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 56, "endLine": 58 } ], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00294": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 71, "endLine": 71 }, { "cwe": "CWE-611", "startLine": 52, "endLine": 52 } ], "modelOnlyMapped": [ { "cwe": "CWE-611", "startLine": 50, "endLine": 52 } ], "modelOnlyVerified": [ { "cwe": "CWE-611", "startLine": 50, "endLine": 52 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 71, "endLine": 71 }, { "cwe": "CWE-611", "startLine": 52, "endLine": 52 } ] }, "BenchmarkTest01090": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00064": { "nativeDeterministic": [ { "cwe": "CWE-79", "startLine": 61, "endLine": 61 }, { "cwe": "CWE-79", "startLine": 67, "endLine": 67 }, { "cwe": "CWE-614", "startLine": 62, "endLine": 62 } ], "modelOnlyMapped": [ { "cwe": "CWE-614", "startLine": 62, "endLine": 65 } ], "modelOnlyVerified": [ { "cwe": "CWE-614", "startLine": 62, "endLine": 65 } ], "servedCombined": [ { "cwe": "CWE-79", "startLine": 61, "endLine": 61 }, { "cwe": "CWE-79", "startLine": 67, "endLine": 67 }, { "cwe": "CWE-614", "startLine": 62, "endLine": 62 } ] }, "BenchmarkTest00938": { "nativeDeterministic": [], "modelOnlyMapped": [], "modelOnlyVerified": [], "servedCombined": [] }, "BenchmarkTest00101": { "nativeDeterministic": [ { "cwe": "CWE-643", "startLine": 55, "endLine": 55 }, { "cwe": "CWE-79", "startLine": 68, "endLine": 68 } ], "modelOnlyMapped": [ { "cwe": "CWE-643", "startLine": 54, "endLine": 55 } ], "modelOnlyVerified": [ { "cwe": "CWE-643", "startLine": 54, "endLine": 55 } ], "servedCombined": [ { "cwe": "CWE-643", "startLine": 55, "endLine": 55 }, { "cwe": "CWE-79", "startLine": 68, "endLine": 68 } ] } }, "gatingStats": [ { "batch": 1, "stats": { "droppedMissingPath": 0, "droppedUnknownPath": 0, "droppedUnlocatedSnippet": 0 } } ], "batching": { "maxFiles": null, "provenance": "Legacy single-batch protocol reconstruction", "batches": [ { "index": 1, "caseIds": [ "BenchmarkTest01109", "BenchmarkTest00619", "BenchmarkTest01173", "BenchmarkTest00168", "BenchmarkTest00670", "BenchmarkTest00096", "BenchmarkTest00192", "BenchmarkTest00455", "BenchmarkTest00732", "BenchmarkTest00265", "BenchmarkTest00426", "BenchmarkTest00422", "BenchmarkTest00148", "BenchmarkTest01077", "BenchmarkTest01058", "BenchmarkTest00621", "BenchmarkTest00071", "BenchmarkTest00072", "BenchmarkTest00513", "BenchmarkTest00510", "BenchmarkTest00151", "BenchmarkTest01178", "BenchmarkTest00540", "BenchmarkTest00294", "BenchmarkTest01090", "BenchmarkTest00064", "BenchmarkTest00938", "BenchmarkTest00101" ] } ] } }, "seal": { "sealedAt": "2026-10-22T09:06:26.784923+00:00", "manifestSha256": "656966c8c77db51cc59de35953498b04660f50cf9eba82e87794b380336e3c98", "selectionSha256": "7837fe49203840f5590c62613eebc144cddf43382c8e0f7c0b3a4d9bdb4c326f", "oldManifestSha256": "f553622a791a8376dcc78b1dd2e85fe00b89f83b428431b1ccdf546cfb790f1a", "newPredictionsSeen": false, "paidCalls": 0, "sourceIdentities": [ { "path": "testcode/BenchmarkTest01109.py", "sha256": "50a81744784ae345fe5e185d4e1e0dcd5f2cd1027da685ab9d0b3587435a90ec" }, { "path": "testcode/BenchmarkTest00619.py", "sha256": "f8c5d506c626838763e389f6fa73422253269ab82b99d971f2b8c43d73f5fd57" }, { "path": "testcode/BenchmarkTest01173.py", "sha256": "cab02e797999547489e145d4fed01cffa2d1e6b7b966868223b2cb2ab486e74b" }, { "path": "testcode/BenchmarkTest00168.py", "sha256": "4ac770cd0c09bb7f0836026f44bfbef036d499eead2925ef195824e2605df169" }, { "path": "testcode/BenchmarkTest00670.py", "sha256": "cf0ffbf2521ef3b2bd5f113f78c6544b99d594f25c581361f2fd0c625b6d1a01" }, { "path": "testcode/BenchmarkTest00096.py", "sha256": "c8448b0fd2b31f66cdd269bf17a5064dbddbdef90586392d2d7ee5114d5cfda0" }, { "path": "testcode/BenchmarkTest00192.py", "sha256": "3b5fc1f1625dcde200acf3c2933dac865dae84477d06ba789c6b5d7c43edfd47" }, { "path": "testcode/BenchmarkTest00455.py", "sha256": "dd5e271f9ac139e7ac99bbde78145027d789ae63357bbcdc5dd5c1987b050eeb" }, { "path": "testcode/BenchmarkTest00732.py", "sha256": "b9669a1638c1ed6b9979107ef0957ecbecd8190ee2fdfa113d9fec7fea382eb3" }, { "path": "testcode/BenchmarkTest00265.py", "sha256": "ae83fc0686dab7903e2b82a58d9c4ef1839bb6040d7374e77ddfc74e49816220" }, { "path": "testcode/BenchmarkTest00426.py", "sha256": "ad6a8e062b226c80882e82f29a128699297e5999db7ba3c6f6bbd4d02419f9e4" }, { "path": "testcode/BenchmarkTest00422.py", "sha256": "e16bed57525e8e1b27cd724cedac15deb040dca744d702b92b109192ba2b9a5c" }, { "path": "testcode/BenchmarkTest00148.py", "sha256": "fa5627181ac92dcd326cb2f17f480b1a1ad228dfb19aa38da3c506686bcb3975" }, { "path": "testcode/BenchmarkTest01077.py", "sha256": "41918ac52be77f9e807a22683317ff2c21f732ec5dff46b6f76423aaf3fe7270" }, { "path": "testcode/BenchmarkTest01058.py", "sha256": "04f37ba243af0fe6a38364ed929f6c95b04ebfc5c993642b65e0ac3e863f0b06" }, { "path": "testcode/BenchmarkTest00621.py", "sha256": "6a292714b56b785093546524b39d419e4695f31f2a58cb0d022673a76c1c190b" }, { "path": "testcode/BenchmarkTest00071.py", "sha256": "02b9ce18abba8a2b4368f21a81c14fb0749cc2cb59106ca0c478b141652e4a44" }, { "path": "testcode/BenchmarkTest00072.py", "sha256": "d467a06b2d69eed8621effc25f1598cf9a8d65b62a174ab8b26110a80ed77ca4" }, { "path": "testcode/BenchmarkTest00513.py", "sha256": "85a879ec61190b92afe6cddbf3fcddad16954677e81c6160680d019a0345a0b2" }, { "path": "testcode/BenchmarkTest00510.py", "sha256": "4d418ee88e8efce4f63a732172b23d25406b3bebc1243546a688425ab0493afc" }, { "path": "testcode/BenchmarkTest00151.py", "sha256": "a00089f0f8902a15c60e8ff1d800dde791fa5eae3779edf1230c307b935fb6d1" }, { "path": "testcode/BenchmarkTest01178.py", "sha256": "fe44ffc9a12d6282ca2cdec4dd0cc495a36545e70856fbc7c90ea0cec5804f75" }, { "path": "testcode/BenchmarkTest00540.py", "sha256": "d29f94759ef5bd84b34b4f8cae70468011a3d06dc4cf57f116f0f5e577bbdb49" }, { "path": "testcode/BenchmarkTest00294.py", "sha256": "08350a96a5aa9a27f69573bb85f3f01265b0eae4d8ddb483409b7b82eb77581a" }, { "path": "testcode/BenchmarkTest01090.py", "sha256": "2190d04cd05886ecc73a95e1b2075ee64a148e89650e5d96aadcefe438dac8f7" }, { "path": "testcode/BenchmarkTest00064.py", "sha256": "8ab91066d9084888be73afd6390d257d358b606cc8de482486587686be44cdb9" }, { "path": "testcode/BenchmarkTest00938.py", "sha256": "9eb6748e839453b9ee9055d4dd41b562df1ede48844c094f0e5c1155a199f304" }, { "path": "testcode/BenchmarkTest00101.py", "sha256": "8a8ba79ecfe9ad2db71b07abfd24563a6f5e422f00490b2f210868e4b012d6c6" } ] }, "rawReceiptPath": "/benchmarks/model-trial-untouched-2026-10-22-dbfd9aaaf0e6a997.json", "receiptSha256": "dbfd9aaaf0e6a9972623f77f4cea27332abd1ebec4035bce7f3d1a5669b33602" } ], "downloads": { "baseline": { "rawReceiptPath": "/benchmarks/model-pilot-baseline-diagnostics-2026-10-22-1d8e4917755e4f8f.json", "receiptSha256": "1d8e4917755e4f8fe65c11961e3f4fccec87e79a6179c4e004b9b89742a5c20b" }, "rerun": { "rawReceiptPath": "/benchmarks/model-followup-development-2026-10-22-b3d8cf6ae1ed05fc.json", "receiptSha256": "b3d8cf6ae1ed05fc4fd0e7c3056c8bfe17b003bcd41c4c327d7348cb131a15cb" }, "untouched": { "rawReceiptPath": "/benchmarks/model-followup-untouched-2026-10-22-3f923cb1a03c9d86.json", "receiptSha256": "3f923cb1a03c9d8627427f8ced651c0e845d4ee15e699dab3ab7372bc9c92b86" } }, "seal": { "sealedAt": "2026-10-22T09:21:03.462655+00:00", "manifestSha256": "058cce4c9e04c745cc05a528d4717c571c4187a6c67ca8cc969eedc37f8efb77", "selectionSha256": "a4fe496267130330165ad3d81b2c46b110a1c88337a626cf8f347df92cfdc150", "oldManifestSha256": "f553622a791a8376dcc78b1dd2e85fe00b89f83b428431b1ccdf546cfb790f1a", "earlierUntouchedManifestSha256": "656966c8c77db51cc59de35953498b04660f50cf9eba82e87794b380336e3c98", "newPredictionsSeen": false, "paidCalls": 0, "sourceIdentities": [ { "path": "testcode/BenchmarkTest01007.py", "sha256": "67971f1915cd821211affd63b8b36456445315fd734fcb359de5e53a45147810" }, { "path": "testcode/BenchmarkTest00615.py", "sha256": "52bebc0f9d08db292cc850e7836682a1fda68664f7af114e25c00d923c222448" }, { "path": "testcode/BenchmarkTest00350.py", "sha256": "52eeea7199c73ff35fdb3e260ed647337df16f962f40a7e5b2e2854eed3c6476" }, { "path": "testcode/BenchmarkTest00167.py", "sha256": "9ccadb894c12ca6ad016aee03830140737f3872c8c3d7bd520814316724a4fd6" }, { "path": "testcode/BenchmarkTest01015.py", "sha256": "6fe8f9a6edc8199cf617ea6a09967aa5e684a206a70fb06c76b17924812e8ad6" }, { "path": "testcode/BenchmarkTest00451.py", "sha256": "3126d8fb33f6bade6bea694afa71da086701a1bf867dee1fbfa0932746e89883" }, { "path": "testcode/BenchmarkTest00287.py", "sha256": "1b9c652c64ed5ff27094d50029745be8262c4f1bb6d1eb464021155ae11581d6" }, { "path": "testcode/BenchmarkTest00284.py", "sha256": "04c951a90cf18546dc9d73adaf38c77a89c4a5feb4dc735ad86e94da26ffccf6" }, { "path": "testcode/BenchmarkTest00348.py", "sha256": "5546e77472ad706eb5065e782b66cec9b12c9d14c96751607aec6c53ebc9e528" }, { "path": "testcode/BenchmarkTest00427.py", "sha256": "60ec9393dc85e226115ef6acb592647c073598ddbdb6e6e94860af5ced291eb8" }, { "path": "testcode/BenchmarkTest00600.py", "sha256": "1252055c6d5eb366d70c6f17f50d3db4e5c614374d6eedb2be55e9d6801ee8d4" }, { "path": "testcode/BenchmarkTest00160.py", "sha256": "a0a5b629d6c62d373f5adedccab68738844d97a4c6f696603fda0b93c096bad0" }, { "path": "testcode/BenchmarkTest00798.py", "sha256": "ca7d8e4a42b1caffa0afacae04aa881cec9440c38956033a8b4f76bbd1259aa8" }, { "path": "testcode/BenchmarkTest00586.py", "sha256": "fb2bbc1d572e6c8566b87e2f336af60b0c68f60026d3889532ca8b7376ab8926" }, { "path": "testcode/BenchmarkTest00694.py", "sha256": "b7a1d4a7140383340673cc9cd8a8453f8e9e7db0a49be799ae1bfb9daa294659" }, { "path": "testcode/BenchmarkTest00626.py", "sha256": "f649713f591b955b3972101bb9addaffa902389d9a58e3a9fac126c8e5a67bad" }, { "path": "testcode/BenchmarkTest01162.py", "sha256": "8a2bdb74a500ef829454abe8ed8d3189fde084121f44f7bced0c1c57e352d920" }, { "path": "testcode/BenchmarkTest00338.py", "sha256": "e32e47738921d7cec592d0799e74ba5bc9ae341be0d7b77fe39703d3c7e2a329" }, { "path": "testcode/BenchmarkTest00609.py", "sha256": "83cf5531d3f0052cf422a5c8434b4f9f8cffee3899991a44c2c148f208406b60" }, { "path": "testcode/BenchmarkTest00270.py", "sha256": "5dc0afd9732e8f154d5a20b72b1a5962d9db45df07bba03790c4f5f99f36f96c" }, { "path": "testcode/BenchmarkTest00419.py", "sha256": "835ec5dfe16700aea9e8f18574c79424c688d04d91f4e2884895add188ac1130" }, { "path": "testcode/BenchmarkTest00655.py", "sha256": "c4430a1fdfaf5021260176a5af512c1f072256202e617dda9bd1e86154022e7d" }, { "path": "testcode/BenchmarkTest00291.py", "sha256": "65d36fbc3ea2769fbb9c826c773f80240f54ce48aef13ece68f8ceb39ce2dd64" }, { "path": "testcode/BenchmarkTest00931.py", "sha256": "937290bb758786591fe3df1e6826d3198a2978ca0f11fac9d2b24923e81978ac" }, { "path": "testcode/BenchmarkTest00813.py", "sha256": "d454674ec4cc6d2a239d699b0de6838f0e4947c652e6ed68c72b6b49f01cbf53" }, { "path": "testcode/BenchmarkTest00981.py", "sha256": "e7c8025753d04eb1eb0b114b638cf35d1bee7bb8a6581d138274d2faac8be9a6" }, { "path": "testcode/BenchmarkTest01117.py", "sha256": "e00710191997d6ddd81a90588de720e59ccd41f29dd19dff399cac97b1353897" }, { "path": "testcode/BenchmarkTest00217.py", "sha256": "c29d179625863390b237b59e47de0021a6db1aaa27d0c2fcce36b3e4060969bb" } ] }, "distinctModelCases": 84, "finalPairCostUsdUpperBound": 0.1056558, "trialCostUsdUpperBound": 0.10839479999999999, "followupCostUsdUpperBound": 0.21405059999999998, "cumulativeCostUsdUpperBound": 0.2439582, "policy": { "scoring": "Strict original expected CWE and sink-line overlap are unchanged. All original labels, anchors and source identities are retained. Related CWE or nearby-line findings are diagnostic metadata only and receive no extra scoring credit. Diagnostic finding lines are model-localized after source binding; they do not prove exploit execution.", "development": "The original 28 cases and outcomes informed prompt/verifier improvements. Their rerun is label-informed development evidence, not an unseen evaluation. Both positive and safe-case transitions remain visible. Earlier prompt-only trial results and costs remain published even when they did not improve recall.", "untouched": "Each new balanced 28-case cohort excludes all earlier model-evaluated IDs. A publication evaluator selected it by frozen hash ranking and reviewed anchors before predictions, without sharing its selected source with prompt implementers. The public suite and deterministic corpus were already used in development; these are not independent repository holdouts. Training contamination and prior familiarity remain unknown.", "production": "These runs measure code-default detection-stage prompt, source mapping, verification and native union behavior with serialized concurrency. Actual production runtime model configuration was not independently verified. Imported helper bodies, application execution, extra scan lanes, repairs, PRs and full hosted scan behavior are outside this measurement.", "costs": "The original pilot, prompt-update trials and final follow-up runs share a declared $1 cumulative cap. Calculated peak price bounds use returned token usage, retaining request reservations when usage is unknown. Account billing and complete hosted product costs are not independently verified." } }