From 3c36f13e03a01dc04b8828c5ed381e915bb281b2 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Sat, 5 Sep 2026 10:37:53 +0200 Subject: [PATCH] feat(pair-corpus-honesty): LLM-generated Real-Vuln repos and unlicensed agent fixes as pointer pairs Task 8.4 (Req 10.6, 5.1). - harvest.merge_recipes appends recipes by name and never rewrites existing rows. - vibe-py/build_recipes.py --pointers: the 40 LLM-generated repositories without a license become vendored = false rows (80 pairs, agent, seeded) appended to recipes.toml; unlicensed human repos stay skipped. - agent-vfc/build_recipes.py --from ... --pointers [--cache]: unlicensed agent-authored fixes become title-tier pointer rows whose function label is derived from the cached excerpt (30 added from a fresh 662-candidate search); TOML booleans rendered correctly. - catalogs regenerated: vibe-py 115 rows (35 vendored + 80 pointer), agent-vfc 59 (29 + 30); no excerpt is vendored for any pointer row. - `pairs --slice vibe-py --pointers` scores both provenances (human 35, agent 80); the default run skips 80 pairs with pointer_pair_skipped; suite and gates unchanged. README/docs name the nightly command. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG --- .kiro/specs/pair-corpus-honesty/tasks.md | 1 + README.md | 1 + benchmarks/pairs/README.md | 3 + benchmarks/pairs/agent-vfc/README.md | 4 +- benchmarks/pairs/agent-vfc/build_recipes.py | 133 +- benchmarks/pairs/agent-vfc/catalog.toml | 936 +++++++ benchmarks/pairs/agent-vfc/recipes.toml | 816 ++++++ benchmarks/pairs/harvest.py | 7 + benchmarks/pairs/vibe-py/README.md | 10 +- benchmarks/pairs/vibe-py/build_recipes.py | 26 +- benchmarks/pairs/vibe-py/catalog.toml | 2720 +++++++++++++++++++ benchmarks/pairs/vibe-py/recipes.toml | 2640 ++++++++++++++++++ docs/examples.md | 1 + tests/test_pair_corpus.py | 26 +- tests/test_pair_harvest.py | 98 + 15 files changed, 7380 insertions(+), 42 deletions(-) diff --git a/.kiro/specs/pair-corpus-honesty/tasks.md b/.kiro/specs/pair-corpus-honesty/tasks.md index afd1273..4713c38 100644 --- a/.kiro/specs/pair-corpus-honesty/tasks.md +++ b/.kiro/specs/pair-corpus-honesty/tasks.md @@ -199,6 +199,7 @@ - Task 8.3 (2026-09-05, RED first: 6 failing tests captured — `pointer_recipe`/`select_vendored` missing, loader `KeyError: 'vuln'` on a `vendored = false` row (x2), `pairs --pointers` unknown flag (`SystemExit: 2`), `validate_recipe(require_license=)` unknown, `catalog_gen` skipped pointer recipes as missing excerpts; then green): `PairCase.vendored`/`recipe`, `pair_cache_dir` (`OPENULTRASAST_PAIR_CACHE`, default `~/.cache/openultrasast/pairs`), `network_allowed` (`--pointers` per run or `OPENULTRASAST_PAIRS_NETWORK=1`), `select_vendored`, `_pointer_ready` (cached -> score; network -> `harvest.materialize_pointer` via the shared library; else `pointer_pair_skipped`; a failed fetch is `pointer_pair_fetch_failed`), `evaluate_catalog(pointers=)`; `harvest.validate_recipe(require_license=False)` and `materialize_pointer` (cache only, redaction applies); `catalog_gen` emits `vendored = false` rows with recipe fields and no excerpts, training manifest skips them; `pair_gate` scores vendored local pairs only; `.gitignore` covers the cache path. Smoke with real network on two Real-Vuln LLM-repo recipes into a scratchpad cache: network off -> 0 outcomes, 2 x `pointer_pair_skipped`; network on -> both harvested to `/vibe-py//{vuln,fixed}.py` and scored (silent fix on both, vuln side undetected, unresolved 0); nothing written under the repository. Suite 479 passed / 4 skipped, extra-free 466 / 17, ruff/mypy clean, three gates PASS. - Review round 9 (2026-09-05) REJECTED 8.3 on two findings, both fixed RED-first (2 failing tests captured: warm cache + network off scored the pointer pair; `evaluate_profiles` kept an `agent` pointer pair): `_pointer_ready` consults `network_allowed` before the cache, so a warm cache only spares the fetch under `--pointers`/env and never turns a default run into a pointer run; `evolve.evaluate_profiles` applies `select_vendored` before the tier filter (design amendment: "tests and gates call `select_vendored`"; ProfileGate is the gate the design names, so the one-line filter is in boundary). Suggestions applied: fetch failures carry a `detail`; the harvest module load is memoized; pointer excerpt headers get `function`/`mechanism` from the expected row; `tests/conftest.py` autouse fixture clears `OPENULTRASAST_PAIRS_NETWORK` and points the cache at a temp dir for every test; full-catalog on-disk assertions use `select_vendored`. - Review round 10 (2026-09-05) APPROVED 8.3 (verify-completion: `pytest -q` 481 passed / 4 skipped; extra-free 468 / 17 inside a no-network namespace; ruff/format/mypy clean; three gates PASS; reviewer reproduced both RED tests by mutation, the warm-cache/network-off skip on the real cache, and that the default run creates no cache and touches no network). Non-blocking: top-level README/docs mention `--pointers` only in benchmarks/pairs/README.md (ride with 8.4); the cwd-relative harvest library path follows the DEFAULT_CATALOG convention. +- Task 8.4 (2026-09-05, RED first: 4 failing tests captured — `build(pointers=)` unknown in the vibe-py builder, `merge_recipes` missing from the harvest library, the agent-vfc writer rendered booleans as strings, no pointer rows in the default catalog; then green): `harvest.merge_recipes` appends new recipes by name and never rewrites existing rows; `vibe-py/build_recipes.py --pointers` keeps the LLM-generated unlicensed repositories as `vendored = false`, `agent`, `review_tier = "seeded"` rows and appends them to recipes.toml (80 pairs over the 40 repositories; the 36 pre-existing recipes are byte-for-byte identical after reload; unlicensed human repositories stay skipped); `agent-vfc/build_recipes.py --from ... --pointers [--cache]` inverts the license rule, harvests each unlicensed candidate into the cache to derive its function label with `catalog_gen.derive_function`, dedupes against known commits/repos, and appends `title` pointer rows (30 added from a fresh 662-candidate search; 2 candidates failed to harvest, 10 had no named function; the 39 pre-existing recipes are identical). Catalogs regenerated: vibe-py 115 rows (35 vendored + 80 pointer), agent-vfc 59 rows (29 vendored + 30 pointer); training manifests unchanged (pointer rows carry no vendored files). Evidence for the observable, cache in the scratchpad: `pairs --slice vibe-py --pointers --json` scored 115 pairs, per_profile human 35 (13 correct, Youden +0.371) and agent 80 (0 correct, Youden 0.000; the LLM-repo baseline), all 80 pointer pairs fetched, no fetch failure; `pairs --slice agent-vfc --pointers --json` 1/59, Youden 0.000, unresolved 2; the default `pairs --slice vibe-py --json` scores 35 pairs and records 80 `pointer_pair_skipped`; `~/.cache/openultrasast` was never created. README/docs name the nightly `--pointers` command. Suite and gates unchanged (see round 11). - ESCALATION (task 5.1 observable): vibe-py has `human` provenance only because the 40 LLM-generated Real-Vuln repos have no license (Req 5.4 wins). Spec owner decision needed: accept human-only vibe-py, or obtain a license statement upstream. - ESCALATION (Req 5.3): agent-vfc rows are unreviewed. They are NOT in the loaded catalog; `benchmarks/pairs/agent-vfc/catalog-candidates.toml` and `REVIEW.md` list them for a human reviewer. Task 5.3 stays open until reviewed. diff --git a/README.md b/README.md index 87e47be..f9ae7de 100644 --- a/README.md +++ b/README.md @@ -33,6 +33,7 @@ uv run ousast benchmark benchmarks/manifests/python-vulnerable.toml --mode quick # Differential pair eval: fire on vuln, stay silent on the fix (local + real GitHub VFCs) uv run ousast pairs uv run ousast pairs --slice sast # OWASP Benchmark Java/Python + Juliet +uv run ousast pairs --slice vibe-py --pointers # nightly: also harvest non-vendored pointer pairs into ~/.cache uv run python -m openultrasast.pair_gate # Run the bounded self-improvement loop over the ruleset (benchmark-driven) diff --git a/benchmarks/pairs/README.md b/benchmarks/pairs/README.md index 81ad01c..5956036 100644 --- a/benchmarks/pairs/README.md +++ b/benchmarks/pairs/README.md @@ -69,6 +69,9 @@ and `reviewed` pairs, so `advisory` and `title` pairs never gate the improve loo ## Pointer pairs (not vendored) +Current pointer rows: vibe-py 80 (the 40 LLM-generated Real-Vuln repositories, `agent`, +`seeded`) and agent-vfc (unlicensed agent-authored fixes, `title`). + A row with `vendored = false` carries its harvest recipe (`repo`, `parent`, `commit`, `path`, `mode`, `line`/`fix_path`/`fix_line`, ...) and no excerpt files (Req 10). The repository never redistributes that code: `pairs --pointers` (or diff --git a/benchmarks/pairs/agent-vfc/README.md b/benchmarks/pairs/agent-vfc/README.md index 43b6ac4..d5b3f6a 100644 --- a/benchmarks/pairs/agent-vfc/README.md +++ b/benchmarks/pairs/agent-vfc/README.md @@ -2,7 +2,9 @@ Security-fix commits carrying an AI coding agent co-author trailer or generation marker (Claude Code, Codex, Cursor, Copilot, Devin), in JavaScript, TypeScript, or Python. -`provenance = "agent"`. Only repositories with a stated license are vendored. +`provenance = "agent"`. Only repositories with a stated license are vendored; fixes in +unlicensed repositories are `vendored = false` pointer rows (`build_recipes.py --from ... --pointers`, +function label derived from the cached excerpt) scored by `ousast pairs --slice agent-vfc --pointers`. ## Review checklist (Req 5.3) diff --git a/benchmarks/pairs/agent-vfc/build_recipes.py b/benchmarks/pairs/agent-vfc/build_recipes.py index 30bfb00..21277cc 100644 --- a/benchmarks/pairs/agent-vfc/build_recipes.py +++ b/benchmarks/pairs/agent-vfc/build_recipes.py @@ -131,11 +131,41 @@ def classify(title: str) -> tuple[str, str, str] | None: return None -def build(source: Path, *, limit: int, max_lines: int) -> tuple[list[dict[str, object]], dict[str, int]]: +def _pair_tools() -> tuple[object, object]: + """The shared harvest library and catalog generator (pointer recipes need a cached excerpt to derive their function).""" + import importlib.util + + modules = [] + for name, path in (("pair_harvest_lib", ROOT.parent / "harvest.py"), ("catalog_gen_lib", ROOT.parent / "catalog_gen.py")): + spec = importlib.util.spec_from_file_location(name, path) + assert spec is not None and spec.loader is not None + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + modules.append(module) + return modules[0], modules[1] + + +def build( + source: Path, *, limit: int, max_lines: int, pointers: bool = False, cache: Path | None = None, known: set[str] | None = None +) -> tuple[list[dict[str, object]], dict[str, int]]: + """``pointers=True`` inverts the license rule: only unlicensed repositories are kept, as ``vendored = false`` rows whose + excerpts live in ``cache`` (fetched here to derive the function label; Req 10.6). ``known`` commits/repos are skipped.""" recipes: list[dict[str, object]] = [] - skipped = {"noise_title": 0, "unclassified": 0, "unlicensed": 0, "no_code_file": 0, "too_big": 0, "api": 0, "duplicate_repo": 0} + skipped = { + "noise_title": 0, + "unclassified": 0, + "unlicensed": 0, + "licensed": 0, + "no_code_file": 0, + "too_big": 0, + "api": 0, + "duplicate_repo": 0, + "harvest": 0, + "no_function": 0, + } per_repo: dict[str, int] = {} - seen_commits: set[str] = set() # the same fix commit shows up in every fork + seen_commits: set[str] = set(known or ()) # the same fix commit shows up in every fork + harvest, catalog_gen = _pair_tools() if pointers else (None, None) rows = [json.loads(line) for line in source.read_text().splitlines() if line.strip()] for row in sorted(rows, key=lambda r: (r["repo"], r["date"])): if len(recipes) >= limit: @@ -148,7 +178,7 @@ def build(source: Path, *, limit: int, max_lines: int) -> tuple[list[dict[str, o if classified is None: skipped["unclassified"] += 1 continue - if per_repo.get(row["repo"], 0) >= 2 or row["sha"] in seen_commits: + if per_repo.get(row["repo"], 0) >= (1 if pointers else 2) or row["sha"] in seen_commits or row["repo"] in seen_commits: skipped["duplicate_repo"] += 1 continue seen_commits.add(row["sha"]) @@ -161,7 +191,10 @@ def build(source: Path, *, limit: int, max_lines: int) -> tuple[list[dict[str, o continue assert isinstance(info, dict) and isinstance(commit, dict) license_id = (info.get("license") or {}).get("spdx_id") or "" - if license_id not in ACCEPTED_LICENSES: + if pointers and license_id in ACCEPTED_LICENSES: + skipped["licensed"] += 1 # licensed fixes are vendored by the default mode, not pointed at + continue + if not pointers and license_id not in ACCEPTED_LICENSES: skipped["unlicensed"] += 1 continue files = [f for f in commit.get("files", []) if _CODE.search(f["filename"]) and not _SKIP.search(f["filename"]) and f.get("patch")] @@ -183,33 +216,47 @@ def build(source: Path, *, limit: int, max_lines: int) -> tuple[list[dict[str, o language = {".py": "python", ".ts": "typescript", ".tsx": "typescript"}.get(suffix, "javascript") base = re.sub(r"[^a-z0-9]+", "-", f"{row['repo'].split('/')[-1]}-{Path(target['filename']).stem}".lower()).strip("-")[:56] name = f"{base}-{row['sha'][:6]}" + recipe: dict[str, object] = { + "name": name, + "host": "github", + "repo": row["repo"], + "parent": parents[0]["sha"], + "commit": commit["sha"], + "path": target["filename"], + "mode": "hunk", + "language": language, + "relpath": target["filename"], + "license": license_id, + "cve": "", + "year": int(str(commit["commit"]["author"]["date"])[:4]), + "cwe": cwe, + "class": cls, + "mechanism": mechanism, + "provenance": "agent", + "origin": "github-agent-trailer", + "project": row["repo"].split("/")[-1], + "trailer": trailer[:120], + "reviewer": "pending", + "evidence": title[:200], + "commit_url": f"https://github.com/{row['repo']}/commit/{commit['sha']}", + } + if pointers: + assert harvest is not None and catalog_gen is not None and cache is not None + recipe["license"] = "unlicensed" + recipe["vendored"] = False + try: + harvest.materialize_pointer(recipe, cache, slice_name="agent-vfc") # type: ignore[attr-defined] + except Exception as exc: # noqa: BLE001 - a candidate that cannot be fetched is skipped, not fatal + skipped["harvest"] += 1 + print(f"skip {name}: {str(exc)[:100]}") + continue + function = catalog_gen.derive_function(cache / "agent-vfc", recipe) # type: ignore[attr-defined] + if not function: + skipped["no_function"] += 1 + continue + recipe["function"] = function per_repo[row["repo"]] = per_repo.get(row["repo"], 0) + 1 - recipes.append( - { - "name": name, - "host": "github", - "repo": row["repo"], - "parent": parents[0]["sha"], - "commit": commit["sha"], - "path": target["filename"], - "mode": "hunk", - "language": language, - "relpath": target["filename"], - "license": license_id, - "cve": "", - "year": int(str(commit["commit"]["author"]["date"])[:4]), - "cwe": cwe, - "class": cls, - "mechanism": mechanism, - "provenance": "agent", - "origin": "github-agent-trailer", - "project": row["repo"].split("/")[-1], - "trailer": trailer[:120], - "reviewer": "pending", - "evidence": title[:200], - "commit_url": f"https://github.com/{row['repo']}/commit/{commit['sha']}", - } - ) + recipes.append(recipe) for index, recipe in enumerate(sorted(recipes, key=lambda r: str(r["name"]))): recipe["split"] = "holdout" if index % 2 else "train" return recipes, skipped @@ -224,7 +271,9 @@ def to_toml(recipes: list[dict[str, object]]) -> str: for recipe in sorted(recipes, key=lambda r: str(r["name"])): lines.append("[[recipe]]") for key, value in recipe.items(): - if isinstance(value, int) and not isinstance(value, bool): + if isinstance(value, bool): + lines.append(f"{key} = {'true' if value else 'false'}") + elif isinstance(value, int): lines.append(f"{key} = {value}") else: lines.append(f'{key} = "{str(value).replace(chr(92), chr(92) * 2).replace(chr(34), chr(92) + chr(34))}"') @@ -239,11 +288,29 @@ def main(argv: list[str] | None = None) -> int: parser.add_argument("--limit", type=int, default=40) parser.add_argument("--max-lines", type=int, default=80) parser.add_argument("--out", type=Path, default=ROOT / "recipes.toml") + parser.add_argument( + "--pointers", action="store_true", help="unlicensed repos only, as vendored = false rows appended to --out (Req 10.6)" + ) + parser.add_argument( + "--cache", type=Path, default=None, help="pointer cache root (default: OPENULTRASAST_PAIR_CACHE or ~/.cache/openultrasast/pairs)" + ) args = parser.parse_args(argv) if args.search: print(f"searched {search(args.search)} candidates -> {args.search}") if args.source: - recipes, skipped = build(args.source, limit=args.limit, max_lines=args.max_lines) + import os + import tomllib + + existing = [dict(r) for r in tomllib.loads(args.out.read_text()).get("recipe", [])] if args.out.is_file() else [] + if args.pointers: + cache = args.cache or Path(os.environ.get("OPENULTRASAST_PAIR_CACHE") or Path.home() / ".cache" / "openultrasast" / "pairs") + known = {str(r["commit"]) for r in existing} | {str(r["repo"]) for r in existing} + new, skipped = build(args.source, limit=args.limit, max_lines=args.max_lines, pointers=True, cache=cache, known=known) + harvest, _ = _pair_tools() + recipes, added = harvest.merge_recipes(existing, new) # type: ignore[attr-defined] + print(f"appended {len(added)} pointer recipes") + else: + recipes, skipped = build(args.source, limit=args.limit, max_lines=args.max_lines) args.out.write_text(to_toml(recipes), encoding="utf-8") print(f"wrote {args.out} ({len(recipes)} recipes); skipped {skipped}") return 0 diff --git a/benchmarks/pairs/agent-vfc/catalog.toml b/benchmarks/pairs/agent-vfc/catalog.toml index 5e7717b..84c4602 100644 --- a/benchmarks/pairs/agent-vfc/catalog.toml +++ b/benchmarks/pairs/agent-vfc/catalog.toml @@ -3,6 +3,68 @@ # Do not add these names to LANGUAGE_MANIFESTS. # Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml. +[[pair]] +name = "ah-05-07-main-0f68d7" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "AI-HealthCare-05/AH_05_07" +cve = "" +cwe = "CWE-16" +commit = "0f68d71093ec0b64a4374f50a7e832e00a39170e" +parent = "350f67510bce9de606fa3ccca2a90bcd79789d7c" +commit_url = "https://github.com/AI-HealthCare-05/AH_05_07/commit/0f68d71093ec0b64a4374f50a7e832e00a39170e" +vendored = false +host = "github" +path = "app/main.py" +mode = "hunk" +relpath = "app/main.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "app/main.py" +function = "request_validation_error_handler" +mechanism = "permissive_default" +evidence = "fix: allow browser updates through CORS (#115)" + +[[pair]] +name = "ai-file-manager-searcher-2c8f65" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Rem763/ai-file-manager" +cve = "" +cwe = "CWE-89" +commit = "2c8f6556131405338fd63f989556ff7481e8a706" +parent = "96416d160231278e898135a1d193c2b9d26ec341" +commit_url = "https://github.com/Rem763/ai-file-manager/commit/2c8f6556131405338fd63f989556ff7481e8a706" +vendored = false +host = "github" +path = "ai-file-manager/core/searcher.py" +mode = "hunk" +relpath = "ai-file-manager/core/searcher.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-89" +class = "sql injection" +path = "ai-file-manager/core/searcher.py" +function = "search" +mechanism = "source_reaches_sink" +evidence = "fix: SQL injection hardening and API cleanup for searcher" + [[pair]] name = "anastasios-pw-session-14ec1a" slice = "agent-vfc" @@ -61,6 +123,131 @@ function = "isTopLevelNavigationRequest" mechanism = "source_reaches_sink" evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" +[[pair]] +name = "audienceos-command-center-route-7b2b31" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Diiiploy/audienceos-command-center" +cve = "" +cwe = "CWE-601" +commit = "7b2b31e33cd5f582bc5f06e39b139154d08c5ad6" +parent = "f79cc1bc6288709bc33af5168fbaf5970122f3e8" +commit_url = "https://github.com/Diiiploy/audienceos-command-center/commit/7b2b31e33cd5f582bc5f06e39b139154d08c5ad6" +vendored = false +host = "github" +path = "app/auth/callback/route.ts" +mode = "hunk" +relpath = "app/auth/callback/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "app/auth/callback/route.ts" +function = "GET" +mechanism = "source_reaches_sink" +evidence = "security(auth): harden OAuth callback against open redirect and error leakage" + +[[pair]] +name = "backend-gym-main-37aec0" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "JhonatanAbrigo11/backend-gym" +cve = "" +cwe = "CWE-16" +commit = "37aec05262214c538a7543cf92921ff478e2d621" +parent = "42a704179bb0c053de4dc8508f692fc25f828953" +commit_url = "https://github.com/JhonatanAbrigo11/backend-gym/commit/37aec05262214c538a7543cf92921ff478e2d621" +vendored = false +host = "github" +path = "backend/src/main.ts" +mode = "hunk" +relpath = "backend/src/main.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "backend/src/main.ts" +function = "bootstrap" +mechanism = "permissive_default" +sink = "path" +evidence = "fix: allow Vercel frontend origin in CORS" + +[[pair]] +name = "bricks-document-viewer-client-8daa7c" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Lamisi/Bricks" +cve = "" +cwe = "CWE-862" +commit = "8daa7c83d71475f8d23c0d9c6a4ee21813281c8d" +parent = "12501c96609d8b6de2117bed9cc42829085c4f7b" +commit_url = "https://github.com/Lamisi/Bricks/commit/8daa7c83d71475f8d23c0d9c6a4ee21813281c8d" +vendored = false +host = "github" +path = "components/document-viewer-client.tsx" +mode = "hunk" +relpath = "components/document-viewer-client.tsx" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-862" +class = "missing authorization" +path = "components/document-viewer-client.tsx" +function = "openPdfExport" +mechanism = "missing_auth_guard" +evidence = "Fix GCM decryption missing authentication tag length (#98) (#102)" + +[[pair]] +name = "bushiri-index-bd1c99" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Handoni/BUSHIRI" +cve = "" +cwe = "CWE-16" +commit = "bd1c99277aa6808b440a9f3c9267d477a07c8d48" +parent = "5da2a544ec6328f9fe39d6c897af7d5f196471f4" +commit_url = "https://github.com/Handoni/BUSHIRI/commit/bd1c99277aa6808b440a9f3c9267d477a07c8d48" +vendored = false +host = "github" +path = "apps/worker/src/index.ts" +mode = "hunk" +relpath = "apps/worker/src/index.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "apps/worker/src/index.ts" +function = "resolveCorsOrigin" +mechanism = "permissive_default" +evidence = "fix: Worker CORS 허용 Origin 추가" + [[pair]] name = "capgo-app-hono-4dadd2" slice = "agent-vfc" @@ -90,6 +277,99 @@ function = "createHono" mechanism = "permissive_default" evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)" +[[pair]] +name = "career-copilot-matches-eaa75e" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "ahmednashatnoaman-svg/career-copilot" +cve = "" +cwe = "CWE-639" +commit = "eaa75e6b04449a69fcae82461eca3bd67931f8c9" +parent = "6dacd24d8c300eab5eb69b605ffafad68a60c008" +commit_url = "https://github.com/ahmednashatnoaman-svg/career-copilot/commit/eaa75e6b04449a69fcae82461eca3bd67931f8c9" +vendored = false +host = "github" +path = "app/api/matches.py" +mode = "hunk" +relpath = "app/api/matches.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "app/api/matches.py" +function = "list_matches" +mechanism = "identity_from_request_body" +evidence = "security: fix IDOR in matches API — use request.state.user_id instead of query param" + +[[pair]] +name = "chatpro-index-99dcd3" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "anggiadiputra/chatpro" +cve = "" +cwe = "CWE-16" +commit = "99dcd3c09a3648cb56e2335047ffffff500959fc" +parent = "237ccac69ce0986b8d0ef7f5f295a0aaff8979cb" +commit_url = "https://github.com/anggiadiputra/chatpro/commit/99dcd3c09a3648cb56e2335047ffffff500959fc" +vendored = false +host = "github" +path = "apps/backend/src/index.ts" +mode = "hunk" +relpath = "apps/backend/src/index.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "apps/backend/src/index.ts" +function = "origin" +mechanism = "permissive_default" +evidence = "fix(auth): allow Turnstile token in CORS preflight" + +[[pair]] +name = "comp-6000-capstone2-index-388195" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "SpaceRobot-268369/COMP-6000-Capstone2" +cve = "" +cwe = "CWE-16" +commit = "388195676bb0fec13a4d1163f6cb5c7155198e97" +parent = "a4c42810ee353ad87e6dc8f7f751c0dc8375a42d" +commit_url = "https://github.com/SpaceRobot-268369/COMP-6000-Capstone2/commit/388195676bb0fec13a4d1163f6cb5c7155198e97" +vendored = false +host = "github" +path = "backend/src/index.js" +mode = "hunk" +relpath = "backend/src/index.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "backend/src/index.js" +function = "origin" +mechanism = "permissive_default" +evidence = "Fix backend CORS origin reflection" + [[pair]] name = "dnf-plugin-anyrepo-config-26d19a" slice = "agent-vfc" @@ -119,6 +399,37 @@ function = "validate_repo_name" mechanism = "path_join_user_input" evidence = "fix(config): prevent path traversal in repository names" +[[pair]] +name = "easy-q-api-a31c36" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "LucRoDZ/EASY-.Q" +cve = "" +cwe = "CWE-862" +commit = "a31c36230f3902a3c2a4aa191de2528dd5993620" +parent = "f9b8fac326e9c45522bf8008dfedf6875b2449f6" +commit_url = "https://github.com/LucRoDZ/EASY-.Q/commit/a31c36230f3902a3c2a4aa191de2528dd5993620" +vendored = false +host = "github" +path = "frontend/src/api.js" +mode = "hunk" +relpath = "frontend/src/api.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-862" +class = "missing authorization" +path = "frontend/src/api.js" +function = "listTables" +mechanism = "missing_auth_guard" +evidence = "fix(auth): add Bearer token to all missing authenticated API calls" + [[pair]] name = "edutrace-page-ee7ba2" slice = "agent-vfc" @@ -148,6 +459,69 @@ function = "handleInputChange" mechanism = "prototype_pollution" evidence = "fix(front): impedir prototype pollution nos handlers de formulário aninhado" +[[pair]] +name = "ems-contract-analyzer-app-00884c" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "chgreer1070/ems-contract-analyzer" +cve = "" +cwe = "CWE-22" +commit = "00884c98d1c43db4b647077e7f30d0ec84eaccb9" +parent = "440c38fd0a48dc70f183f2bd972258a1dc17c45e" +commit_url = "https://github.com/chgreer1070/ems-contract-analyzer/commit/00884c98d1c43db4b647077e7f30d0ec84eaccb9" +vendored = false +host = "github" +path = "app.py" +mode = "hunk" +relpath = "app.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "app.py" +function = "analyze" +mechanism = "path_join_user_input" +sink = "path" +evidence = "Fix security issues: path traversal, debug mode, migrate PyPDF2 to pypdf" + +[[pair]] +name = "enterprise-ai-lakehouse-platform-main-11e36d" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "KIRAN4056/enterprise-ai-lakehouse-platform" +cve = "" +cwe = "CWE-89" +commit = "11e36da584c79ee622faa0786a44a31d6fecf685" +parent = "5f6a17f4fb49752633c2b33c123609c1118ab883" +commit_url = "https://github.com/KIRAN4056/enterprise-ai-lakehouse-platform/commit/11e36da584c79ee622faa0786a44a31d6fecf685" +vendored = false +host = "github" +path = "processing/query-engine/python-engine/main.py" +mode = "hunk" +relpath = "processing/query-engine/python-engine/main.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-89" +class = "sql injection" +path = "processing/query-engine/python-engine/main.py" +function = "execute_query" +mechanism = "source_reaches_sink" +evidence = "fix: Address SQL injection vulnerabilities in query engine and MLflow services" + [[pair]] name = "etude-lexical-markdown-editorconfig-c61a8b" slice = "agent-vfc" @@ -206,6 +580,287 @@ function = "deepMergeInto" mechanism = "prototype_pollution" evidence = "fix: make prototype pollution guard recognizable by CodeQL" +[[pair]] +name = "findconstructionstaffing-route-24edf4" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "boweiliu/findconstructionstaffing" +cve = "" +cwe = "CWE-601" +commit = "24edf4ad9c506fcb7df7878f7c25827307863fb6" +parent = "ff1338c0f2d4bb27a2499f82a16b2908635ec66f" +commit_url = "https://github.com/boweiliu/findconstructionstaffing/commit/24edf4ad9c506fcb7df7878f7c25827307863fb6" +vendored = false +host = "github" +path = "app/auth/callback/route.ts" +mode = "hunk" +relpath = "app/auth/callback/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "app/auth/callback/route.ts" +function = "GET" +mechanism = "source_reaches_sink" +evidence = "fix(auth): add open redirect protection and improve test types" + +[[pair]] +name = "fitnesstracker-communityfoods-115204" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "JimmyMc1213/fitnesstracker" +cve = "" +cwe = "CWE-16" +commit = "1152045961b896dca319f2dabc0467444a72d38c" +parent = "a9bc50f9b5fecaa3c8ddb739f327fdbd74972e52" +commit_url = "https://github.com/JimmyMc1213/fitnesstracker/commit/1152045961b896dca319f2dabc0467444a72d38c" +vendored = false +host = "github" +path = "src/fitness/communityFoods.ts" +mode = "hunk" +relpath = "src/fitness/communityFoods.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "src/fitness/communityFoods.ts" +function = "upsertCommunityFood" +mechanism = "permissive_default" +evidence = "Fix barcode scan saves to community_foods by handling upsert errors and RLS." + +[[pair]] +name = "flytte24-views-8a5f7a" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "bogdantro/flytte24" +cve = "" +cwe = "CWE-601" +commit = "8a5f7afbd901af696514842e6e174318802f1219" +parent = "63f71e32ec916f6a4cde737cbde262bd61185d56" +commit_url = "https://github.com/bogdantro/flytte24/commit/8a5f7afbd901af696514842e6e174318802f1219" +vendored = false +host = "github" +path = "apps/dashboard/views.py" +mode = "hunk" +relpath = "apps/dashboard/views.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "apps/dashboard/views.py" +function = "business_toggle_active" +mechanism = "source_reaches_sink" +evidence = "fix: address final review findings (open redirect, missing confirm dialog, stylesheet path, seeded illustrations, rating validation)" + +[[pair]] +name = "fusmle-index-47f075" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "am-gs/FUSMLE" +cve = "" +cwe = "CWE-798" +commit = "47f07502c588a2aaf9cf8d75aa918d51fd114bb1" +parent = "b216e440fef42b38f33dbdcd61bee98d6407aa51" +commit_url = "https://github.com/am-gs/FUSMLE/commit/47f07502c588a2aaf9cf8d75aa918d51fd114bb1" +vendored = false +host = "github" +path = "vercel/uworld-api-deploy/index.py" +mode = "hunk" +relpath = "vercel/uworld-api-deploy/index.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-798" +class = "hardcoded credentials" +path = "vercel/uworld-api-deploy/index.py" +function = "qbank_generate_test" +mechanism = "secret_in_client" +evidence = "security: fix vulnerable deps, restrict CORS, drop hardcoded secret, validate input" + +[[pair]] +name = "green-mobile-offline-backend-example-482952" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "aurelien-sema/GREEN-mobile-offline" +cve = "" +cwe = "CWE-22" +commit = "482952a41b9abb23bfcb726a97c6cca72c5165a1" +parent = "75af5411ff56de45f979d8abd60b69d915ed2198" +commit_url = "https://github.com/aurelien-sema/GREEN-mobile-offline/commit/482952a41b9abb23bfcb726a97c6cca72c5165a1" +vendored = false +host = "github" +path = "backend_example.py" +mode = "hunk" +relpath = "backend_example.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "backend_example.py" +function = "detect_disease" +mechanism = "path_join_user_input" +sink = "open" +evidence = "security: fix hardcoded signing password, path traversal, cleartext traffic, weak PBKDF2 & CORS" + +[[pair]] +name = "iterviz-orchestrator-c59620" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Ezimakyu/IterViz" +cve = "" +cwe = "CWE-22" +commit = "c59620161a32a1e3c1ab332fd5e487fa1a101e16" +parent = "62341c4b967b8361080b918a62891e0bdb6b570d" +commit_url = "https://github.com/Ezimakyu/IterViz/commit/c59620161a32a1e3c1ab332fd5e487fa1a101e16" +vendored = false +host = "github" +path = "backend/app/orchestrator.py" +mode = "hunk" +relpath = "backend/app/orchestrator.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "backend/app/orchestrator.py" +function = "create_assignments" +mechanism = "path_join_user_input" +evidence = "fix(m5): address Devin Review issues (path traversal, idempotency, ws race)" + +[[pair]] +name = "jogo-da-velha-rotas-326bac" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Moon15810/jogo-da-velha" +cve = "" +cwe = "CWE-601" +commit = "326bac6435718a958d9ef41ec5339077c89ff64a" +parent = "351095cda75f65fce82218b792136bea6d863d4c" +commit_url = "https://github.com/Moon15810/jogo-da-velha/commit/326bac6435718a958d9ef41ec5339077c89ff64a" +vendored = false +host = "github" +path = "plataforma/auth/rotas.py" +mode = "hunk" +relpath = "plataforma/auth/rotas.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "plataforma/auth/rotas.py" +function = "login" +mechanism = "source_reaches_sink" +evidence = "fix: valida o parametro next no login (evita open redirect)" + +[[pair]] +name = "joidy-main-a2fa2c" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Axel-DaMage/joidy" +cve = "" +cwe = "CWE-89" +commit = "a2fa2c6f6c1ffd15394309952ebfcc3e7715fcc7" +parent = "c26b1055eae2d74ed7d51c860adc6864c75f19a6" +commit_url = "https://github.com/Axel-DaMage/joidy/commit/a2fa2c6f6c1ffd15394309952ebfcc3e7715fcc7" +vendored = false +host = "github" +path = "ai-service/main.py" +mode = "hunk" +relpath = "ai-service/main.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-89" +class = "sql injection" +path = "ai-service/main.py" +function = "cluster_notes" +mechanism = "source_reaches_sink" +sink = "execute" +evidence = "fix(ai-service): fix connection leak and SQL injection in /cluster endpoint (#614)" + +[[pair]] +name = "learnly-page-a4c6b2" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "ParanyuLion/Learnly" +cve = "" +cwe = "CWE-601" +commit = "a4c6b2259340151fbc0411ad1c778d3caa2aea76" +parent = "30b667e4dfbaac7b6f380ea3a53fafbc41a65795" +commit_url = "https://github.com/ParanyuLion/Learnly/commit/a4c6b2259340151fbc0411ad1c778d3caa2aea76" +vendored = false +host = "github" +path = "app/login/page.tsx" +mode = "hunk" +relpath = "app/login/page.tsx" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "app/login/page.tsx" +function = "submit" +mechanism = "source_reaches_sink" +evidence = "fix: validate login redirect target to prevent open redirect (final review fix)" + [[pair]] name = "lensops-kubernetesmanagement-fe4910" slice = "agent-vfc" @@ -380,6 +1035,37 @@ function = "normalizeInput" mechanism = "prototype_pollution" evidence = "fix(core): add prototype pollution guard to normalizeInput" +[[pair]] +name = "neutral-server-033e5f" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "El-Ninjo1965/Neutral" +cve = "" +cwe = "CWE-16" +commit = "033e5f0f6f325e0a52fc13fe24f8e3b7ae2c30fd" +parent = "9eb92fb1b843f4e558c72549264a9156930bf72a" +commit_url = "https://github.com/El-Ninjo1965/Neutral/commit/033e5f0f6f325e0a52fc13fe24f8e3b7ae2c30fd" +vendored = false +host = "github" +path = "server/bootstrap/server.js" +mode = "hunk" +relpath = "server/bootstrap/server.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "server/bootstrap/server.js" +function = "sendJson" +mechanism = "permissive_default" +evidence = "Fix PHP setup save and CORS bootstrap" + [[pair]] name = "new-erp-final-app-6e9644" slice = "agent-vfc" @@ -438,6 +1124,69 @@ function = "GET" mechanism = "source_reaches_sink" evidence = "fix: resolve command injection and SSRF/Open Redirect security issues in multiScraper and image proxy API" +[[pair]] +name = "niners-initializecollections-b90f9c" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Ja9vill/Niners" +cve = "" +cwe = "CWE-798" +commit = "b90f9c325cf63cc6fe39dd046606301c2af9d119" +parent = "3e828f4f08ea0d09181226857c71e6e6b725bdff" +commit_url = "https://github.com/Ja9vill/Niners/commit/b90f9c325cf63cc6fe39dd046606301c2af9d119" +vendored = false +host = "github" +path = "scripts/initializeCollections.js" +mode = "hunk" +relpath = "scripts/initializeCollections.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-798" +class = "hardcoded credentials" +path = "scripts/initializeCollections.js" +function = "runInitialization" +mechanism = "secret_in_client" +evidence = "fix(security): harden auth, remove hardcoded secrets, protect endpoints" + +[[pair]] +name = "nuvanx-siteground-validate-page-templates-7ccb5b" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "NUVANX-Medicina-Estetica-Laser/nuvanx-siteground" +cve = "" +cwe = "CWE-22" +commit = "7ccb5b352d9ceab76dbad6bebb717a0bb2a71cf7" +parent = "0dc8e7b6cf3f3d3586b136c96bca56658872e4a8" +commit_url = "https://github.com/NUVANX-Medicina-Estetica-Laser/nuvanx-siteground/commit/7ccb5b352d9ceab76dbad6bebb717a0bb2a71cf7" +vendored = false +host = "github" +path = "scripts/validate-page-templates.mjs" +mode = "hunk" +relpath = "scripts/validate-page-templates.mjs" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-22" +class = "path traversal" +path = "scripts/validate-page-templates.mjs" +function = "templateExists" +mechanism = "path_join_user_input" +sink = "path" +evidence = "fix(security): prevent path traversal in template validation" + [[pair]] name = "openniw-jobs-0fc947" slice = "agent-vfc" @@ -613,6 +1362,100 @@ function = "buildUpstreamRequest" mechanism = "permissive_default" evidence = "fix: handle CORS OPTIONS preflight for catalog fetches (#10)" +[[pair]] +name = "shift-left-or-die-database-68a00a" +slice = "agent-vfc" +language = "python" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Krystian-key/shift-left-or-die" +cve = "" +cwe = "CWE-89" +commit = "68a00a547a97b8b9c78cdd1b91d4ad61a7a748bb" +parent = "353a8b384eb24faf34ae11fdcaf2d02b6f74f3bc" +commit_url = "https://github.com/Krystian-key/shift-left-or-die/commit/68a00a547a97b8b9c78cdd1b91d4ad61a7a748bb" +vendored = false +host = "github" +path = "app/database.py" +mode = "hunk" +relpath = "app/database.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-89" +class = "sql injection" +path = "app/database.py" +function = "search_scans_by_query" +mechanism = "source_reaches_sink" +sink = "execute" +evidence = "Fix SQL Injection: Replace f-string SQL with parameterized SQLAlchemy ORM query" + +[[pair]] +name = "signaldigest-route-8ca292" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "bwaide/SignalDigest" +cve = "" +cwe = "CWE-601" +commit = "8ca29233dd9f4603891f626216be6dfd352b0045" +parent = "8f7eb45c5c7cd8ffa71fa3d53730688ab147cf51" +commit_url = "https://github.com/bwaide/SignalDigest/commit/8ca29233dd9f4603891f626216be6dfd352b0045" +vendored = false +host = "github" +path = "app/auth/callback/route.ts" +mode = "hunk" +relpath = "app/auth/callback/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "app/auth/callback/route.ts" +function = "GET" +mechanism = "source_reaches_sink" +evidence = "fix: prevent open redirect vulnerability in auth callback" + +[[pair]] +name = "soulclaw-pw-session-1346a0" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "clawsouls/soulclaw" +cve = "" +cwe = "CWE-918" +commit = "1346a0a62342e86cd083f5373a21cfe0678424ee" +parent = "60712ab1b2f57d180c77d3f25f41837d047309c1" +commit_url = "https://github.com/clawsouls/soulclaw/commit/1346a0a62342e86cd083f5373a21cfe0678424ee" +vendored = false +host = "github" +path = "extensions/browser/src/browser/pw-session.ts" +mode = "hunk" +relpath = "extensions/browser/src/browser/pw-session.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-918" +class = "server-side request forgery" +path = "extensions/browser/src/browser/pw-session.ts" +function = "isTopLevelNavigationRequest" +mechanism = "source_reaches_sink" +evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" + [[pair]] name = "supplieradvisor-mvp-route-387bcf" slice = "agent-vfc" @@ -672,6 +1515,37 @@ mechanism = "identity_from_request_body" sink = "path" evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)" +[[pair]] +name = "tabletap-safe-next-33ff1b" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "chitkid/tabletap" +cve = "" +cwe = "CWE-601" +commit = "33ff1b0ef0301320e7fa3984bee4e5146ae1f8d5" +parent = "3871de5c3523283a65132250a38aa8650a865f49" +commit_url = "https://github.com/chitkid/tabletap/commit/33ff1b0ef0301320e7fa3984bee4e5146ae1f8d5" +vendored = false +host = "github" +path = "apps/web/lib/safe-next.ts" +mode = "hunk" +relpath = "apps/web/lib/safe-next.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-601" +class = "open redirect" +path = "apps/web/lib/safe-next.ts" +function = "safeNext" +mechanism = "source_reaches_sink" +evidence = "fix(web): close the backslash open redirect in safeNext" + [[pair]] name = "tools-cli-tools-a96bc0" slice = "agent-vfc" @@ -701,6 +1575,37 @@ function = "_is_command_allowed" mechanism = "source_reaches_sink" evidence = "🛡️ Sentinel: [CRITICAL] Fix command injection in ShellTool (#3307)" +[[pair]] +name = "tracechantier-web-route-cbdafd" +slice = "agent-vfc" +language = "typescript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "TraceChantier/tracechantier-web" +cve = "" +cwe = "CWE-639" +commit = "cbdafd847aeea247f42482e169267558b201d434" +parent = "bd44165738fef8c37679eaf18eefe52eb05bb018" +commit_url = "https://github.com/TraceChantier/tracechantier-web/commit/cbdafd847aeea247f42482e169267558b201d434" +vendored = false +host = "github" +path = "app/api/modifier-chantier/route.ts" +mode = "hunk" +relpath = "app/api/modifier-chantier/route.ts" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-639" +class = "insecure direct object reference" +path = "app/api/modifier-chantier/route.ts" +function = "POST" +mechanism = "identity_from_request_body" +evidence = "Update video copy + fix IDOR on zone deletion" + [[pair]] name = "trackly-cli-path-diagnostics-1c1aed" slice = "agent-vfc" @@ -730,6 +1635,37 @@ function = "inspectExistingAncestor" mechanism = "path_join_user_input" evidence = "fix(apply): report blocked path traversal" +[[pair]] +name = "unimart-backend-auth-controller-3ee79a" +slice = "agent-vfc" +language = "javascript" +origin = "github-agent-trailer" +license = "unlicensed" +repo = "Richmond-24/unimart-backend" +cve = "" +cwe = "CWE-16" +commit = "3ee79a6123eaba498d40a5f4ba5cc0a6be5fe5c8" +parent = "58e26326cc1f5c01bef96461136ebcb9388fba5d" +commit_url = "https://github.com/Richmond-24/unimart-backend/commit/3ee79a6123eaba498d40a5f4ba5cc0a6be5fe5c8" +vendored = false +host = "github" +path = "src/controllers/auth.controller.js" +mode = "hunk" +relpath = "src/controllers/auth.controller.js" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "title" + +[[pair.expected]] +cwe = "CWE-16" +class = "permissive default" +path = "src/controllers/auth.controller.js" +function = "register" +mechanism = "permissive_default" +evidence = "Fix signup hanging and CORS 'can't connect to server' errors" + [[pair]] name = "upstreamdrift-local-server-c3a078" slice = "agent-vfc" diff --git a/benchmarks/pairs/agent-vfc/recipes.toml b/benchmarks/pairs/agent-vfc/recipes.toml index dc20296..6355573 100644 --- a/benchmarks/pairs/agent-vfc/recipes.toml +++ b/benchmarks/pairs/agent-vfc/recipes.toml @@ -26,6 +26,60 @@ evidence = "fix(hub): allow DSH token validation CORS" commit_url = "https://github.com/1173591564/academic-based-qoder/commit/a79ddb90def54e91f7507cbf6b1548b224d642aa" split = "train" +[[recipe]] +name = "ah-05-07-main-0f68d7" +host = "github" +repo = "AI-HealthCare-05/AH_05_07" +parent = "350f67510bce9de606fa3ccca2a90bcd79789d7c" +commit = "0f68d71093ec0b64a4374f50a7e832e00a39170e" +path = "app/main.py" +mode = "hunk" +language = "python" +relpath = "app/main.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "AH_05_07" +trailer = "Co-authored-by: Codex " +reviewer = "pending" +evidence = "fix: allow browser updates through CORS (#115)" +commit_url = "https://github.com/AI-HealthCare-05/AH_05_07/commit/0f68d71093ec0b64a4374f50a7e832e00a39170e" +vendored = false +function = "request_validation_error_handler" +split = "train" + +[[recipe]] +name = "ai-file-manager-searcher-2c8f65" +host = "github" +repo = "Rem763/ai-file-manager" +parent = "96416d160231278e898135a1d193c2b9d26ec341" +commit = "2c8f6556131405338fd63f989556ff7481e8a706" +path = "ai-file-manager/core/searcher.py" +mode = "hunk" +language = "python" +relpath = "ai-file-manager/core/searcher.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-89" +class = "sql injection" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "ai-file-manager" +trailer = "Co-Authored-By: Claude Opus 4.7 " +reviewer = "pending" +evidence = "fix: SQL injection hardening and API cleanup for searcher" +commit_url = "https://github.com/Rem763/ai-file-manager/commit/2c8f6556131405338fd63f989556ff7481e8a706" +vendored = false +function = "search" +split = "holdout" + [[recipe]] name = "anastasios-pw-session-14ec1a" host = "github" @@ -101,6 +155,115 @@ evidence = "fix(browser): harden SSRF redirect guard against non-navigation docu commit_url = "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b" split = "holdout" +[[recipe]] +name = "audienceos-command-center-route-7b2b31" +host = "github" +repo = "Diiiploy/audienceos-command-center" +parent = "f79cc1bc6288709bc33af5168fbaf5970122f3e8" +commit = "7b2b31e33cd5f582bc5f06e39b139154d08c5ad6" +path = "app/auth/callback/route.ts" +mode = "hunk" +language = "typescript" +relpath = "app/auth/callback/route.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "audienceos-command-center" +trailer = "Co-Authored-By: Claude Opus 4.5 " +reviewer = "pending" +evidence = "security(auth): harden OAuth callback against open redirect and error leakage" +commit_url = "https://github.com/Diiiploy/audienceos-command-center/commit/7b2b31e33cd5f582bc5f06e39b139154d08c5ad6" +vendored = false +function = "GET" +split = "train" + +[[recipe]] +name = "backend-gym-main-37aec0" +host = "github" +repo = "JhonatanAbrigo11/backend-gym" +parent = "42a704179bb0c053de4dc8508f692fc25f828953" +commit = "37aec05262214c538a7543cf92921ff478e2d621" +path = "backend/src/main.ts" +mode = "hunk" +language = "typescript" +relpath = "backend/src/main.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "backend-gym" +trailer = "Co-authored-by: Cursor " +reviewer = "pending" +evidence = "fix: allow Vercel frontend origin in CORS" +commit_url = "https://github.com/JhonatanAbrigo11/backend-gym/commit/37aec05262214c538a7543cf92921ff478e2d621" +vendored = false +sink = "path" +function = "bootstrap" +split = "holdout" + +[[recipe]] +name = "bricks-document-viewer-client-8daa7c" +host = "github" +repo = "Lamisi/Bricks" +parent = "12501c96609d8b6de2117bed9cc42829085c4f7b" +commit = "8daa7c83d71475f8d23c0d9c6a4ee21813281c8d" +path = "components/document-viewer-client.tsx" +mode = "hunk" +language = "typescript" +relpath = "components/document-viewer-client.tsx" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-862" +class = "missing authorization" +mechanism = "missing_auth_guard" +provenance = "agent" +origin = "github-agent-trailer" +project = "Bricks" +trailer = "Co-Authored-By: Claude Sonnet 4.6 " +reviewer = "pending" +evidence = "Fix GCM decryption missing authentication tag length (#98) (#102)" +commit_url = "https://github.com/Lamisi/Bricks/commit/8daa7c83d71475f8d23c0d9c6a4ee21813281c8d" +vendored = false +function = "openPdfExport" +split = "train" + +[[recipe]] +name = "bushiri-index-bd1c99" +host = "github" +repo = "Handoni/BUSHIRI" +parent = "5da2a544ec6328f9fe39d6c897af7d5f196471f4" +commit = "bd1c99277aa6808b440a9f3c9267d477a07c8d48" +path = "apps/worker/src/index.ts" +mode = "hunk" +language = "typescript" +relpath = "apps/worker/src/index.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "BUSHIRI" +trailer = "Co-authored-by: Codex " +reviewer = "pending" +evidence = "fix: Worker CORS 허용 Origin 추가" +commit_url = "https://github.com/Handoni/BUSHIRI/commit/bd1c99277aa6808b440a9f3c9267d477a07c8d48" +vendored = false +function = "resolveCorsOrigin" +split = "holdout" + [[recipe]] name = "capgo-app-apptabs-7d73fd" host = "github" @@ -151,6 +314,87 @@ evidence = "fix(api): CORS for Capacitor localhost WebView (#3105)" commit_url = "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59" split = "holdout" +[[recipe]] +name = "career-copilot-matches-eaa75e" +host = "github" +repo = "ahmednashatnoaman-svg/career-copilot" +parent = "6dacd24d8c300eab5eb69b605ffafad68a60c008" +commit = "eaa75e6b04449a69fcae82461eca3bd67931f8c9" +path = "app/api/matches.py" +mode = "hunk" +language = "python" +relpath = "app/api/matches.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "insecure direct object reference" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "github-agent-trailer" +project = "career-copilot" +trailer = "Co-Authored-By: Claude " +reviewer = "pending" +evidence = "security: fix IDOR in matches API — use request.state.user_id instead of query param" +commit_url = "https://github.com/ahmednashatnoaman-svg/career-copilot/commit/eaa75e6b04449a69fcae82461eca3bd67931f8c9" +vendored = false +function = "list_matches" +split = "train" + +[[recipe]] +name = "chatpro-index-99dcd3" +host = "github" +repo = "anggiadiputra/chatpro" +parent = "237ccac69ce0986b8d0ef7f5f295a0aaff8979cb" +commit = "99dcd3c09a3648cb56e2335047ffffff500959fc" +path = "apps/backend/src/index.ts" +mode = "hunk" +language = "typescript" +relpath = "apps/backend/src/index.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "chatpro" +trailer = "Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>" +reviewer = "pending" +evidence = "fix(auth): allow Turnstile token in CORS preflight" +commit_url = "https://github.com/anggiadiputra/chatpro/commit/99dcd3c09a3648cb56e2335047ffffff500959fc" +vendored = false +function = "origin" +split = "holdout" + +[[recipe]] +name = "comp-6000-capstone2-index-388195" +host = "github" +repo = "SpaceRobot-268369/COMP-6000-Capstone2" +parent = "a4c42810ee353ad87e6dc8f7f751c0dc8375a42d" +commit = "388195676bb0fec13a4d1163f6cb5c7155198e97" +path = "backend/src/index.js" +mode = "hunk" +language = "javascript" +relpath = "backend/src/index.js" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "COMP-6000-Capstone2" +trailer = "Co-authored-by: Codex " +reviewer = "pending" +evidence = "Fix backend CORS origin reflection" +commit_url = "https://github.com/SpaceRobot-268369/COMP-6000-Capstone2/commit/388195676bb0fec13a4d1163f6cb5c7155198e97" +vendored = false +function = "origin" +split = "train" + [[recipe]] name = "dailyforge-server-ed1470" host = "github" @@ -201,6 +445,33 @@ evidence = "fix(config): prevent path traversal in repository names" commit_url = "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0" split = "holdout" +[[recipe]] +name = "easy-q-api-a31c36" +host = "github" +repo = "LucRoDZ/EASY-.Q" +parent = "f9b8fac326e9c45522bf8008dfedf6875b2449f6" +commit = "a31c36230f3902a3c2a4aa191de2528dd5993620" +path = "frontend/src/api.js" +mode = "hunk" +language = "javascript" +relpath = "frontend/src/api.js" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-862" +class = "missing authorization" +mechanism = "missing_auth_guard" +provenance = "agent" +origin = "github-agent-trailer" +project = "EASY-.Q" +trailer = "Co-Authored-By: Claude Sonnet 4.6 " +reviewer = "pending" +evidence = "fix(auth): add Bearer token to all missing authenticated API calls" +commit_url = "https://github.com/LucRoDZ/EASY-.Q/commit/a31c36230f3902a3c2a4aa191de2528dd5993620" +vendored = false +function = "listTables" +split = "holdout" + [[recipe]] name = "edutrace-page-ee7ba2" host = "github" @@ -226,6 +497,61 @@ evidence = "fix(front): impedir prototype pollution nos handlers de formulário commit_url = "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739" split = "train" +[[recipe]] +name = "ems-contract-analyzer-app-00884c" +host = "github" +repo = "chgreer1070/ems-contract-analyzer" +parent = "440c38fd0a48dc70f183f2bd972258a1dc17c45e" +commit = "00884c98d1c43db4b647077e7f30d0ec84eaccb9" +path = "app.py" +mode = "hunk" +language = "python" +relpath = "app.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "github-agent-trailer" +project = "ems-contract-analyzer" +trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>" +reviewer = "pending" +evidence = "Fix security issues: path traversal, debug mode, migrate PyPDF2 to pypdf" +commit_url = "https://github.com/chgreer1070/ems-contract-analyzer/commit/00884c98d1c43db4b647077e7f30d0ec84eaccb9" +vendored = false +sink = "path" +function = "analyze" +split = "train" + +[[recipe]] +name = "enterprise-ai-lakehouse-platform-main-11e36d" +host = "github" +repo = "KIRAN4056/enterprise-ai-lakehouse-platform" +parent = "5f6a17f4fb49752633c2b33c123609c1118ab883" +commit = "11e36da584c79ee622faa0786a44a31d6fecf685" +path = "processing/query-engine/python-engine/main.py" +mode = "hunk" +language = "python" +relpath = "processing/query-engine/python-engine/main.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-89" +class = "sql injection" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "enterprise-ai-lakehouse-platform" +trailer = "Co-Authored-By: Claude Sonnet 5 " +reviewer = "pending" +evidence = "fix: Address SQL injection vulnerabilities in query engine and MLflow services" +commit_url = "https://github.com/KIRAN4056/enterprise-ai-lakehouse-platform/commit/11e36da584c79ee622faa0786a44a31d6fecf685" +vendored = false +function = "execute_query" +split = "holdout" + [[recipe]] name = "etoj-index-605274" host = "github" @@ -301,6 +627,114 @@ evidence = "fix: make prototype pollution guard recognizable by CodeQL" commit_url = "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999" split = "holdout" +[[recipe]] +name = "findconstructionstaffing-route-24edf4" +host = "github" +repo = "boweiliu/findconstructionstaffing" +parent = "ff1338c0f2d4bb27a2499f82a16b2908635ec66f" +commit = "24edf4ad9c506fcb7df7878f7c25827307863fb6" +path = "app/auth/callback/route.ts" +mode = "hunk" +language = "typescript" +relpath = "app/auth/callback/route.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "findconstructionstaffing" +trailer = "Co-Authored-By: Claude Opus 4.5 " +reviewer = "pending" +evidence = "fix(auth): add open redirect protection and improve test types" +commit_url = "https://github.com/boweiliu/findconstructionstaffing/commit/24edf4ad9c506fcb7df7878f7c25827307863fb6" +vendored = false +function = "GET" +split = "train" + +[[recipe]] +name = "fitnesstracker-communityfoods-115204" +host = "github" +repo = "JimmyMc1213/fitnesstracker" +parent = "a9bc50f9b5fecaa3c8ddb739f327fdbd74972e52" +commit = "1152045961b896dca319f2dabc0467444a72d38c" +path = "src/fitness/communityFoods.ts" +mode = "hunk" +language = "typescript" +relpath = "src/fitness/communityFoods.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "fitnesstracker" +trailer = "Co-authored-by: Cursor " +reviewer = "pending" +evidence = "Fix barcode scan saves to community_foods by handling upsert errors and RLS." +commit_url = "https://github.com/JimmyMc1213/fitnesstracker/commit/1152045961b896dca319f2dabc0467444a72d38c" +vendored = false +function = "upsertCommunityFood" +split = "holdout" + +[[recipe]] +name = "flytte24-views-8a5f7a" +host = "github" +repo = "bogdantro/flytte24" +parent = "63f71e32ec916f6a4cde737cbde262bd61185d56" +commit = "8a5f7afbd901af696514842e6e174318802f1219" +path = "apps/dashboard/views.py" +mode = "hunk" +language = "python" +relpath = "apps/dashboard/views.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "flytte24" +trailer = "Co-Authored-By: Claude Sonnet 5 " +reviewer = "pending" +evidence = "fix: address final review findings (open redirect, missing confirm dialog, stylesheet path, seeded illustrations, rating validation)" +commit_url = "https://github.com/bogdantro/flytte24/commit/8a5f7afbd901af696514842e6e174318802f1219" +vendored = false +function = "business_toggle_active" +split = "train" + +[[recipe]] +name = "fusmle-index-47f075" +host = "github" +repo = "am-gs/FUSMLE" +parent = "b216e440fef42b38f33dbdcd61bee98d6407aa51" +commit = "47f07502c588a2aaf9cf8d75aa918d51fd114bb1" +path = "vercel/uworld-api-deploy/index.py" +mode = "hunk" +language = "python" +relpath = "vercel/uworld-api-deploy/index.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-798" +class = "hardcoded credentials" +mechanism = "secret_in_client" +provenance = "agent" +origin = "github-agent-trailer" +project = "FUSMLE" +trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>" +reviewer = "pending" +evidence = "security: fix vulnerable deps, restrict CORS, drop hardcoded secret, validate input" +commit_url = "https://github.com/am-gs/FUSMLE/commit/47f07502c588a2aaf9cf8d75aa918d51fd114bb1" +vendored = false +function = "qbank_generate_test" +split = "holdout" + [[recipe]] name = "gitim-git-cors-proxy-e4c3a4" host = "github" @@ -326,6 +760,143 @@ evidence = "fix(frontend): use gitim cors proxy by default" commit_url = "https://github.com/CiferaTeam/GitIM/commit/e4c3a4794dbe9fbcce679f7df1ecd2b09b40f9d6" split = "train" +[[recipe]] +name = "green-mobile-offline-backend-example-482952" +host = "github" +repo = "aurelien-sema/GREEN-mobile-offline" +parent = "75af5411ff56de45f979d8abd60b69d915ed2198" +commit = "482952a41b9abb23bfcb726a97c6cca72c5165a1" +path = "backend_example.py" +mode = "hunk" +language = "python" +relpath = "backend_example.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "github-agent-trailer" +project = "GREEN-mobile-offline" +trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>" +reviewer = "pending" +evidence = "security: fix hardcoded signing password, path traversal, cleartext traffic, weak PBKDF2 & CORS" +commit_url = "https://github.com/aurelien-sema/GREEN-mobile-offline/commit/482952a41b9abb23bfcb726a97c6cca72c5165a1" +vendored = false +sink = "open" +function = "detect_disease" +split = "train" + +[[recipe]] +name = "iterviz-orchestrator-c59620" +host = "github" +repo = "Ezimakyu/IterViz" +parent = "62341c4b967b8361080b918a62891e0bdb6b570d" +commit = "c59620161a32a1e3c1ab332fd5e487fa1a101e16" +path = "backend/app/orchestrator.py" +mode = "hunk" +language = "python" +relpath = "backend/app/orchestrator.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "github-agent-trailer" +project = "IterViz" +trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>" +reviewer = "pending" +evidence = "fix(m5): address Devin Review issues (path traversal, idempotency, ws race)" +commit_url = "https://github.com/Ezimakyu/IterViz/commit/c59620161a32a1e3c1ab332fd5e487fa1a101e16" +vendored = false +function = "create_assignments" +split = "holdout" + +[[recipe]] +name = "jogo-da-velha-rotas-326bac" +host = "github" +repo = "Moon15810/jogo-da-velha" +parent = "351095cda75f65fce82218b792136bea6d863d4c" +commit = "326bac6435718a958d9ef41ec5339077c89ff64a" +path = "plataforma/auth/rotas.py" +mode = "hunk" +language = "python" +relpath = "plataforma/auth/rotas.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "jogo-da-velha" +trailer = "Co-Authored-By: Claude Opus 4.8 (1M context) " +reviewer = "pending" +evidence = "fix: valida o parametro next no login (evita open redirect)" +commit_url = "https://github.com/Moon15810/jogo-da-velha/commit/326bac6435718a958d9ef41ec5339077c89ff64a" +vendored = false +function = "login" +split = "train" + +[[recipe]] +name = "joidy-main-a2fa2c" +host = "github" +repo = "Axel-DaMage/joidy" +parent = "c26b1055eae2d74ed7d51c860adc6864c75f19a6" +commit = "a2fa2c6f6c1ffd15394309952ebfcc3e7715fcc7" +path = "ai-service/main.py" +mode = "hunk" +language = "python" +relpath = "ai-service/main.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-89" +class = "sql injection" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "joidy" +trailer = "Generated with [Devin](https://devin.ai)" +reviewer = "pending" +evidence = "fix(ai-service): fix connection leak and SQL injection in /cluster endpoint (#614)" +commit_url = "https://github.com/Axel-DaMage/joidy/commit/a2fa2c6f6c1ffd15394309952ebfcc3e7715fcc7" +vendored = false +sink = "execute" +function = "cluster_notes" +split = "holdout" + +[[recipe]] +name = "learnly-page-a4c6b2" +host = "github" +repo = "ParanyuLion/Learnly" +parent = "30b667e4dfbaac7b6f380ea3a53fafbc41a65795" +commit = "a4c6b2259340151fbc0411ad1c778d3caa2aea76" +path = "app/login/page.tsx" +mode = "hunk" +language = "typescript" +relpath = "app/login/page.tsx" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "Learnly" +trailer = "Co-Authored-By: Claude Sonnet 5 " +reviewer = "pending" +evidence = "fix: validate login redirect target to prevent open redirect (final review fix)" +commit_url = "https://github.com/ParanyuLion/Learnly/commit/a4c6b2259340151fbc0411ad1c778d3caa2aea76" +vendored = false +function = "submit" +split = "train" + [[recipe]] name = "lensops-kubernetesmanagement-fe4910" host = "github" @@ -476,6 +1047,33 @@ evidence = "fix(core): add prototype pollution guard to normalizeInput" commit_url = "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8" split = "train" +[[recipe]] +name = "neutral-server-033e5f" +host = "github" +repo = "El-Ninjo1965/Neutral" +parent = "9eb92fb1b843f4e558c72549264a9156930bf72a" +commit = "033e5f0f6f325e0a52fc13fe24f8e3b7ae2c30fd" +path = "server/bootstrap/server.js" +mode = "hunk" +language = "javascript" +relpath = "server/bootstrap/server.js" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "Neutral" +trailer = "Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>" +reviewer = "pending" +evidence = "Fix PHP setup save and CORS bootstrap" +commit_url = "https://github.com/El-Ninjo1965/Neutral/commit/033e5f0f6f325e0a52fc13fe24f8e3b7ae2c30fd" +vendored = false +function = "sendJson" +split = "holdout" + [[recipe]] name = "new-erp-final-app-6e9644" host = "github" @@ -526,6 +1124,61 @@ evidence = "fix: resolve command injection and SSRF/Open Redirect security issue commit_url = "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43" split = "train" +[[recipe]] +name = "niners-initializecollections-b90f9c" +host = "github" +repo = "Ja9vill/Niners" +parent = "3e828f4f08ea0d09181226857c71e6e6b725bdff" +commit = "b90f9c325cf63cc6fe39dd046606301c2af9d119" +path = "scripts/initializeCollections.js" +mode = "hunk" +language = "javascript" +relpath = "scripts/initializeCollections.js" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-798" +class = "hardcoded credentials" +mechanism = "secret_in_client" +provenance = "agent" +origin = "github-agent-trailer" +project = "Niners" +trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>" +reviewer = "pending" +evidence = "fix(security): harden auth, remove hardcoded secrets, protect endpoints" +commit_url = "https://github.com/Ja9vill/Niners/commit/b90f9c325cf63cc6fe39dd046606301c2af9d119" +vendored = false +function = "runInitialization" +split = "train" + +[[recipe]] +name = "nuvanx-siteground-validate-page-templates-7ccb5b" +host = "github" +repo = "NUVANX-Medicina-Estetica-Laser/nuvanx-siteground" +parent = "0dc8e7b6cf3f3d3586b136c96bca56658872e4a8" +commit = "7ccb5b352d9ceab76dbad6bebb717a0bb2a71cf7" +path = "scripts/validate-page-templates.mjs" +mode = "hunk" +language = "javascript" +relpath = "scripts/validate-page-templates.mjs" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "github-agent-trailer" +project = "nuvanx-siteground" +trailer = "Generated with [Devin](https://devin.ai)" +reviewer = "pending" +evidence = "fix(security): prevent path traversal in template validation" +commit_url = "https://github.com/NUVANX-Medicina-Estetica-Laser/nuvanx-siteground/commit/7ccb5b352d9ceab76dbad6bebb717a0bb2a71cf7" +vendored = false +sink = "path" +function = "templateExists" +split = "holdout" + [[recipe]] name = "onlook-helper-57ce1c" host = "github" @@ -726,6 +1379,88 @@ evidence = "Guard against ENABLE ROW LEVEL SECURITY on tables with no policies ( commit_url = "https://github.com/DelfinaCare/rls/commit/d2b6af47347fb285b7a3820a7f2d5dded20907ec" split = "train" +[[recipe]] +name = "shift-left-or-die-database-68a00a" +host = "github" +repo = "Krystian-key/shift-left-or-die" +parent = "353a8b384eb24faf34ae11fdcaf2d02b6f74f3bc" +commit = "68a00a547a97b8b9c78cdd1b91d4ad61a7a748bb" +path = "app/database.py" +mode = "hunk" +language = "python" +relpath = "app/database.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-89" +class = "sql injection" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "shift-left-or-die" +trailer = "Co-Authored-By: Claude Haiku 4.5 " +reviewer = "pending" +evidence = "Fix SQL Injection: Replace f-string SQL with parameterized SQLAlchemy ORM query" +commit_url = "https://github.com/Krystian-key/shift-left-or-die/commit/68a00a547a97b8b9c78cdd1b91d4ad61a7a748bb" +vendored = false +sink = "execute" +function = "search_scans_by_query" +split = "train" + +[[recipe]] +name = "signaldigest-route-8ca292" +host = "github" +repo = "bwaide/SignalDigest" +parent = "8f7eb45c5c7cd8ffa71fa3d53730688ab147cf51" +commit = "8ca29233dd9f4603891f626216be6dfd352b0045" +path = "app/auth/callback/route.ts" +mode = "hunk" +language = "typescript" +relpath = "app/auth/callback/route.ts" +license = "unlicensed" +cve = "" +year = 2025 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "SignalDigest" +trailer = "Co-Authored-By: Claude Sonnet 4.5 " +reviewer = "pending" +evidence = "fix: prevent open redirect vulnerability in auth callback" +commit_url = "https://github.com/bwaide/SignalDigest/commit/8ca29233dd9f4603891f626216be6dfd352b0045" +vendored = false +function = "GET" +split = "holdout" + +[[recipe]] +name = "soulclaw-pw-session-1346a0" +host = "github" +repo = "clawsouls/soulclaw" +parent = "60712ab1b2f57d180c77d3f25f41837d047309c1" +commit = "1346a0a62342e86cd083f5373a21cfe0678424ee" +path = "extensions/browser/src/browser/pw-session.ts" +mode = "hunk" +language = "typescript" +relpath = "extensions/browser/src/browser/pw-session.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-918" +class = "server-side request forgery" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "soulclaw" +trailer = "Co-authored-by: Devin Robison " +reviewer = "pending" +evidence = "fix(browser): harden SSRF redirect guard against non-navigation document hops [AI] (#62355)" +commit_url = "https://github.com/clawsouls/soulclaw/commit/1346a0a62342e86cd083f5373a21cfe0678424ee" +vendored = false +function = "isTopLevelNavigationRequest" +split = "train" + [[recipe]] name = "supplieradvisor-mvp-route-387bcf" host = "github" @@ -776,6 +1511,33 @@ evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing compan commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1" split = "train" +[[recipe]] +name = "tabletap-safe-next-33ff1b" +host = "github" +repo = "chitkid/tabletap" +parent = "3871de5c3523283a65132250a38aa8650a865f49" +commit = "33ff1b0ef0301320e7fa3984bee4e5146ae1f8d5" +path = "apps/web/lib/safe-next.ts" +mode = "hunk" +language = "typescript" +relpath = "apps/web/lib/safe-next.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "github-agent-trailer" +project = "tabletap" +trailer = "Co-Authored-By: Claude Fable 5.1 " +reviewer = "pending" +evidence = "fix(web): close the backslash open redirect in safeNext" +commit_url = "https://github.com/chitkid/tabletap/commit/33ff1b0ef0301320e7fa3984bee4e5146ae1f8d5" +vendored = false +function = "safeNext" +split = "holdout" + [[recipe]] name = "tools-cli-tools-a96bc0" host = "github" @@ -826,6 +1588,33 @@ evidence = "fix(security): validate mesh filenames against path traversal in _do commit_url = "https://github.com/D-sorganization/Tools/commit/e18686aaa174a8a4843c07b4727771c92e0f179e" split = "train" +[[recipe]] +name = "tracechantier-web-route-cbdafd" +host = "github" +repo = "TraceChantier/tracechantier-web" +parent = "bd44165738fef8c37679eaf18eefe52eb05bb018" +commit = "cbdafd847aeea247f42482e169267558b201d434" +path = "app/api/modifier-chantier/route.ts" +mode = "hunk" +language = "typescript" +relpath = "app/api/modifier-chantier/route.ts" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "insecure direct object reference" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "github-agent-trailer" +project = "tracechantier-web" +trailer = "Co-Authored-By: claude-flow " +reviewer = "pending" +evidence = "Update video copy + fix IDOR on zone deletion" +commit_url = "https://github.com/TraceChantier/tracechantier-web/commit/cbdafd847aeea247f42482e169267558b201d434" +vendored = false +function = "POST" +split = "train" + [[recipe]] name = "trackly-cli-path-diagnostics-1c1aed" host = "github" @@ -851,6 +1640,33 @@ evidence = "fix(apply): report blocked path traversal" commit_url = "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6" split = "holdout" +[[recipe]] +name = "unimart-backend-auth-controller-3ee79a" +host = "github" +repo = "Richmond-24/unimart-backend" +parent = "58e26326cc1f5c01bef96461136ebcb9388fba5d" +commit = "3ee79a6123eaba498d40a5f4ba5cc0a6be5fe5c8" +path = "src/controllers/auth.controller.js" +mode = "hunk" +language = "javascript" +relpath = "src/controllers/auth.controller.js" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-16" +class = "permissive default" +mechanism = "permissive_default" +provenance = "agent" +origin = "github-agent-trailer" +project = "unimart-backend" +trailer = "Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>" +reviewer = "pending" +evidence = "Fix signup hanging and CORS 'can't connect to server' errors" +commit_url = "https://github.com/Richmond-24/unimart-backend/commit/3ee79a6123eaba498d40a5f4ba5cc0a6be5fe5c8" +vendored = false +function = "register" +split = "holdout" + [[recipe]] name = "upstreamdrift-local-server-c3a078" host = "github" diff --git a/benchmarks/pairs/harvest.py b/benchmarks/pairs/harvest.py index 37e3bf9..701b899 100644 --- a/benchmarks/pairs/harvest.py +++ b/benchmarks/pairs/harvest.py @@ -553,6 +553,13 @@ def fetch_url(url: str, timeout: int = 60) -> str: return response.read().decode("utf-8", "replace") +def merge_recipes(existing: list[dict[str, Any]], new: list[dict[str, Any]]) -> tuple[list[dict[str, Any]], list[str]]: + """Append ``new`` recipes whose name is not already present; existing rows are never rewritten (vendored labels stay put).""" + names = {str(r["name"]) for r in existing} + added = [r for r in new if str(r["name"]) not in names] + return [*existing, *added], [str(r["name"]) for r in added] + + def load_recipes(path: Path) -> tuple[dict[str, Any], ...]: payload = tomllib.loads(path.read_text()) return tuple(dict(item) for item in payload.get("recipe", [])) diff --git a/benchmarks/pairs/vibe-py/README.md b/benchmarks/pairs/vibe-py/README.md index 6ccae58..d491210 100644 --- a/benchmarks/pairs/vibe-py/README.md +++ b/benchmarks/pairs/vibe-py/README.md @@ -7,9 +7,11 @@ Isolated Python web functions from [Real-Vuln-Benchmark](https://github.com/kole - **Fixed twin**: a false-positive trap function (`is_vulnerable = false`) from the same repository. The scanner must stay silent there, so silent-on-fix here measures precision on traps. - **Provenance**: `human` for the 26 human-authored apps, `agent` for the 40 LLM-generated apps. - The LLM-generated repositories (`kolega-ai-dev/vc-*`) currently carry **no license file**, - so they are skipped by `build_recipes.py` and not vendored (Req 5.4). Re-run with - `--allow-unlicensed` only to inspect them locally; do not commit those excerpts. + The LLM-generated repositories (`kolega-ai-dev/vc-*`) carry **no license file**, so they + are never vendored (Req 5.4): `build_recipes.py --pointers` appends them as `vendored = false` + rows (80 pairs over the 40 repositories, `agent`, `review_tier = "seeded"`) that + `ousast pairs --slice vibe-py --pointers` harvests into the local cache and scores (Req 10). + The default run skips them with `pointer_pair_skipped`. - **Caveat**: the human corpus is educational and CTF style (DVPWA, VAmPI, vulpy, ...), not production code. Say so when reading numbers. - **Matching**: every row names the function; the upstream scorer tolerates ±10 lines, ours @@ -19,5 +21,5 @@ Isolated Python web functions from [Real-Vuln-Benchmark](https://github.com/kole fail stdlib `ast.parse` ("unexpected indent") while tree-sitter parses them with correct function ranges. `parse_failed 0` rests on tree-sitter; stdlib-ast parity would need dedenting. -Rebuild: see the docstring of `build_recipes.py`. Regenerate the catalog with +Rebuild: see the docstring of `build_recipes.py` (add `--pointers` for the LLM repositories). Regenerate the catalog with `python benchmarks/pairs/catalog_gen.py --slice vibe-py`. Maintainer only; CI never fetches. diff --git a/benchmarks/pairs/vibe-py/build_recipes.py b/benchmarks/pairs/vibe-py/build_recipes.py index 26d824e..5883a1f 100644 --- a/benchmarks/pairs/vibe-py/build_recipes.py +++ b/benchmarks/pairs/vibe-py/build_recipes.py @@ -87,8 +87,10 @@ def _slug(text: str) -> str: def build( - ground_truth: Path, licenses: Path, *, per_repo: int, classes: set[str], allow_unlicensed: bool + ground_truth: Path, licenses: Path, *, per_repo: int, classes: set[str], allow_unlicensed: bool, pointers: bool = False ) -> tuple[list[dict[str, object]], dict[str, int]]: + """``pointers=True`` keeps the LLM-generated repositories without a license as ``vendored = false`` rows (Req 10.6): + scored through the cache with ``pairs --pointers``, never vendored. Unlicensed human repositories stay skipped.""" manifest = json.loads((ground_truth / "manifest.json").read_text()) license_by_repo = json.loads(licenses.read_text()) if licenses.is_file() else {} recipes: list[dict[str, object]] = [] @@ -100,7 +102,9 @@ def build( gt = json.loads(gt_path.read_text()) info = license_by_repo.get(repo_id, {}) license_id = info.get("license") or "" - if license_id not in ACCEPTED_LICENSES and not allow_unlicensed: + licensed = license_id in ACCEPTED_LICENSES + pointer = pointers and not licensed and meta["authorship"] == "llm_generated" + if not licensed and not allow_unlicensed and not pointer: skipped["unlicensed"] += 1 continue full = info.get("full") or "/".join(meta["repo_url"].rstrip("/").split("/")[-2:]) @@ -171,6 +175,9 @@ def build( "commit_url": f"https://github.com/{full}/blob/{commit}/{file}#L{int(location['start_line'])}", } ) + if pointer: + recipes[-1]["vendored"] = False + recipes[-1]["review_tier"] = "seeded" # ground truth reviewed upstream; the code is never redistributed taken += 1 # deterministic holdout: every other recipe by sorted name for index, recipe in enumerate(sorted(recipes, key=lambda r: str(r["name"]))): @@ -208,6 +215,9 @@ def main(argv: list[str] | None = None) -> int: parser.add_argument("--per-repo", type=int, default=2) parser.add_argument("--classes", default=",".join(DEFAULT_CLASSES)) parser.add_argument("--allow-unlicensed", action="store_true", help="include repositories without a stated license (NOT for vendoring)") + parser.add_argument( + "--pointers", action="store_true", help="append the LLM-generated unlicensed repos as vendored = false rows to --out (Req 10.6)" + ) parser.add_argument("--out", type=Path, default=ROOT / "recipes.toml") args = parser.parse_args(argv) recipes, skipped = build( @@ -216,7 +226,19 @@ def main(argv: list[str] | None = None) -> int: per_repo=args.per_repo, classes=set(args.classes.split(",")), allow_unlicensed=args.allow_unlicensed, + pointers=args.pointers, ) + if args.pointers and args.out.is_file(): + import importlib.util + import tomllib + + spec = importlib.util.spec_from_file_location("pair_harvest_lib", ROOT.parent / "harvest.py") + assert spec is not None and spec.loader is not None + harvest = importlib.util.module_from_spec(spec) + spec.loader.exec_module(harvest) + existing = [dict(r) for r in tomllib.loads(args.out.read_text()).get("recipe", [])] + recipes, added = harvest.merge_recipes(existing, [r for r in recipes if r.get("vendored") is False]) + print(f"appended {len(added)} pointer recipes to {args.out}") args.out.write_text(to_toml(recipes), encoding="utf-8") print(f"wrote {args.out} ({len(recipes)} recipes); skipped {skipped}") return 0 diff --git a/benchmarks/pairs/vibe-py/catalog.toml b/benchmarks/pairs/vibe-py/catalog.toml index 5d06b1d..e160400 100644 --- a/benchmarks/pairs/vibe-py/catalog.toml +++ b/benchmarks/pairs/vibe-py/catalog.toml @@ -3,6 +3,2046 @@ # Do not add these names to LANGUAGE_MANIFESTS. # Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml. +[[pair]] +name = "claude-code-seeded-v2-crm-saas-django-partner-console-acct-p" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-22" +commit = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +parent = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django/blob/5deee4e20becf5fa4193ce4e68f9e736a3d048c9/crm_project/partner_console.py#L36" +vendored = false +host = "github" +path = "crm_project/partner_console.py" +fix_path = "crm_project/partner_console.py" +mode = "enclosing" +line = 36 +fix_line = 19 +relpath = "crm_project/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "crm_project/partner_console.py" +function = "acct_packet_pull_002" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-crm-saas-django-partner-console-acct-r" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-639" +commit = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +parent = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django/blob/5deee4e20becf5fa4193ce4e68f9e736a3d048c9/crm_project/partner_console.py#L28" +vendored = false +host = "github" +path = "crm_project/partner_console.py" +fix_path = "crm_project/partner_console.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "crm_project/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "crm_project/partner_console.py" +function = "acct_roster_card_001" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-education-lms-django-course-operati-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-601" +commit = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +parent = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django/blob/e4dfb85400f8747ea0418e1f48e65fdef678a96a/lms/course_operations.py#L63" +vendored = false +host = "github" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +relpath = "lms/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "lms/course_operations.py" +function = "course_return_lane_150" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-education-lms-django-course-operations" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-79" +commit = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +parent = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django/blob/e4dfb85400f8747ea0418e1f48e65fdef678a96a/lms/course_operations.py#L28" +vendored = false +host = "github" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "lms/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "lms/course_operations.py" +function = "course_blurb_card_004" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-fintech-lending-fastapi-loan-operat-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-502" +commit = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +parent = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi/blob/d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64/backend/app/loan_operations.py#L51" +vendored = false +host = "github" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +relpath = "backend/app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "backend/app/loan_operations.py" +function = "loan_bundle_thaw_168" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-fintech-lending-fastapi-loan-operation" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-601" +commit = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +parent = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi/blob/d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64/backend/app/loan_operations.py#L38" +vendored = false +host = "github" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +relpath = "backend/app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/loan_operations.py" +function = "loan_return_lane_009" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-healthcare-clinic-django-patient-op-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-502" +commit = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +parent = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django/blob/48c7195d18089f77e3d3d9e197c6a2862c2798e0/clinic_portal/patient_operations.py#L60" +vendored = false +host = "github" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +relpath = "clinic_portal/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "clinic_portal/patient_operations.py" +function = "patient_bundle_thaw_169" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-healthcare-clinic-django-patient-opera" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-601" +commit = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +parent = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django/blob/48c7195d18089f77e3d3d9e197c6a2862c2798e0/clinic_portal/patient_operations.py#L54" +vendored = false +host = "github" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +relpath = "clinic_portal/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "clinic_portal/patient_operations.py" +function = "patient_return_lane_145" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-hr-payroll-django-payroll-operation-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-22" +commit = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +parent = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django/blob/bdd60d0f8896af0f77a628d8ebe8fa24fa385d56/hr_portal/payroll_operations.py#L36" +vendored = false +host = "github" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 36 +fix_line = 19 +relpath = "hr_portal/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "hr_portal/payroll_operations.py" +function = "payroll_fold_drop_014" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-hr-payroll-django-payroll-operations-p" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-639" +commit = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +parent = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django/blob/bdd60d0f8896af0f77a628d8ebe8fa24fa385d56/hr_portal/payroll_operations.py#L28" +vendored = false +host = "github" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "hr_portal/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "hr_portal/payroll_operations.py" +function = "payroll_rollcard_013" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-legal-case-django-case-operations-c-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-502" +commit = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +parent = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django/blob/3c38d4caf4386567c26bd136f5baddfeb51fc302/legal_firm/case_operations.py#L63" +vendored = false +host = "github" +path = "legal_firm/case_operations.py" +fix_path = "legal_firm/case_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +relpath = "legal_firm/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "legal_firm/case_operations.py" +function = "case_bundle_thaw_171" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-legal-case-django-case-operations-case" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-79" +commit = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +parent = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django/blob/3c38d4caf4386567c26bd136f5baddfeb51fc302/legal_firm/case_operations.py#L28" +vendored = false +host = "github" +path = "legal_firm/case_operations.py" +fix_path = "legal_firm/case_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "legal_firm/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "legal_firm/case_operations.py" +function = "case_banner_fold_016" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-502" +commit = "047e3a2471ed7c14793c19798c460882cb1d1de1" +parent = "047e3a2471ed7c14793c19798c460882cb1d1de1" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/blob/047e3a2471ed7c14793c19798c460882cb1d1de1/backend/app/dispatch_operations.py#L51" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "backend/app/dispatch_operations.py" +function = "dispatch_bundle_thaw_172" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-op" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-601" +commit = "047e3a2471ed7c14793c19798c460882cb1d1de1" +parent = "047e3a2471ed7c14793c19798c460882cb1d1de1" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/blob/047e3a2471ed7c14793c19798c460882cb1d1de1/backend/app/dispatch_operations.py#L38" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/dispatch_operations.py" +function = "dispatch_afterlane_021" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-79" +commit = "2e8df4229d046364594b69e049f94d95e933e60d" +parent = "2e8df4229d046364594b69e049f94d95e933e60d" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/blob/2e8df4229d046364594b69e049f94d95e933e60d/backend/app/seller_operations.py#L70" +vendored = false +host = "github" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 70 +fix_line = 16 +relpath = "backend/app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "backend/app/seller_operations.py" +function = "seller_blurb_tile_321" +mechanism = "source_reaches_sink" +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-op" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-601" +commit = "2e8df4229d046364594b69e049f94d95e933e60d" +parent = "2e8df4229d046364594b69e049f94d95e933e60d" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/blob/2e8df4229d046364594b69e049f94d95e933e60d/backend/app/seller_operations.py#L43" +vendored = false +host = "github" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +relpath = "backend/app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/seller_operations.py" +function = "seller_return_lane_146" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-property-management-fastapi-tenant--2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-22" +commit = "001737a4c9f94ab57bec0635509b8a745a3d0482" +parent = "001737a4c9f94ab57bec0635509b8a745a3d0482" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi/blob/001737a4c9f94ab57bec0635509b8a745a3d0482/backend/app/tenant_operations.py#L29" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "backend/app/tenant_operations.py" +function = "lease_docu_slot_026" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-property-management-fastapi-tenant-ope" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-639" +commit = "001737a4c9f94ab57bec0635509b8a745a3d0482" +parent = "001737a4c9f94ab57bec0635509b8a745a3d0482" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi/blob/001737a4c9f94ab57bec0635509b8a745a3d0482/backend/app/tenant_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "backend/app/tenant_operations.py" +function = "tenant_ledger_tile_025" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-support-desk-fastapi-support-operat-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-601" +commit = "837945410ef4cbd1651e4d6d41f30bf61442e174" +parent = "837945410ef4cbd1651e4d6d41f30bf61442e174" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi/blob/837945410ef4cbd1651e4d6d41f30bf61442e174/backend/app/support_operations.py#L41" +vendored = false +host = "github" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 41 +fix_line = 16 +relpath = "backend/app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/support_operations.py" +function = "ticket_return_lane_148" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "claude-code-seeded-v2-support-desk-fastapi-support-operation" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-79" +commit = "837945410ef4cbd1651e4d6d41f30bf61442e174" +parent = "837945410ef4cbd1651e4d6d41f30bf61442e174" +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi/blob/837945410ef4cbd1651e4d6d41f30bf61442e174/backend/app/support_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "backend/app/support_operations.py" +function = "ticket_copy_badge_028" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-crm-saas-django-partner-console-acct-fo" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-639" +commit = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +parent = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django/blob/de186e3d9694f7d39579a6f8d0e40fe7d4d64784/config/partner_console.py#L28" +vendored = false +host = "github" +path = "config/partner_console.py" +fix_path = "config/partner_console.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "config/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "config/partner_console.py" +function = "acct_folio_badge_061" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-crm-saas-django-partner-console-acct-va" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-22" +commit = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +parent = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django/blob/de186e3d9694f7d39579a6f8d0e40fe7d4d64784/config/partner_console.py#L36" +vendored = false +host = "github" +path = "config/partner_console.py" +fix_path = "config/partner_console.py" +mode = "enclosing" +line = 36 +fix_line = 19 +relpath = "config/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "config/partner_console.py" +function = "acct_vaultlet_pull_062" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-education-lms-django-course-operatio-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-601" +commit = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +parent = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django/blob/0a542ba3abbff8c2a8fbc5f9aa4d530d276582df/education_lms/course_operations.py#L63" +vendored = false +host = "github" +path = "education_lms/course_operations.py" +fix_path = "education_lms/course_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +relpath = "education_lms/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "education_lms/course_operations.py" +function = "course_return_lane_162" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-education-lms-django-course-operations-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-79" +commit = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +parent = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django/blob/0a542ba3abbff8c2a8fbc5f9aa4d530d276582df/education_lms/course_operations.py#L28" +vendored = false +host = "github" +path = "education_lms/course_operations.py" +fix_path = "education_lms/course_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "education_lms/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "education_lms/course_operations.py" +function = "course_memo_badge_064" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-fintech-lending-fastapi-loan-operati-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-502" +commit = "056336c2bf4e00df7864ab36290218fc6ede117d" +parent = "056336c2bf4e00df7864ab36290218fc6ede117d" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi/blob/056336c2bf4e00df7864ab36290218fc6ede117d/app/loan_operations.py#L51" +vendored = false +host = "github" +path = "app/loan_operations.py" +fix_path = "app/loan_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +relpath = "app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "app/loan_operations.py" +function = "loan_bundle_thaw_178" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-fintech-lending-fastapi-loan-operations" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-601" +commit = "056336c2bf4e00df7864ab36290218fc6ede117d" +parent = "056336c2bf4e00df7864ab36290218fc6ede117d" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi/blob/056336c2bf4e00df7864ab36290218fc6ede117d/app/loan_operations.py#L38" +vendored = false +host = "github" +path = "app/loan_operations.py" +fix_path = "app/loan_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +relpath = "app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "app/loan_operations.py" +function = "loan_aftercard_069" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-healthcare-clinic-django-patient-ope-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-502" +commit = "83ffa47b05666e0c9f462628540b2146ddf5055a" +parent = "83ffa47b05666e0c9f462628540b2146ddf5055a" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django/blob/83ffa47b05666e0c9f462628540b2146ddf5055a/clinic_portal/patient_operations.py#L60" +vendored = false +host = "github" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +relpath = "clinic_portal/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "clinic_portal/patient_operations.py" +function = "patient_bundle_thaw_179" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-healthcare-clinic-django-patient-operat" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-601" +commit = "83ffa47b05666e0c9f462628540b2146ddf5055a" +parent = "83ffa47b05666e0c9f462628540b2146ddf5055a" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django/blob/83ffa47b05666e0c9f462628540b2146ddf5055a/clinic_portal/patient_operations.py#L54" +vendored = false +host = "github" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +relpath = "clinic_portal/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "clinic_portal/patient_operations.py" +function = "patient_return_lane_157" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-hr-payroll-django-payroll-operations-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-22" +commit = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +parent = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django/blob/df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9/hr_portal/payroll_operations.py#L36" +vendored = false +host = "github" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 36 +fix_line = 19 +relpath = "hr_portal/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "hr_portal/payroll_operations.py" +function = "payroll_zipper_note_074" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-hr-payroll-django-payroll-operations-pa" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-639" +commit = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +parent = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django/blob/df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9/hr_portal/payroll_operations.py#L28" +vendored = false +host = "github" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "hr_portal/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "hr_portal/payroll_operations.py" +function = "payroll_cycle_tile_073" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-legal-case-django-case-operations-ca-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-502" +commit = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +parent = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django/blob/de226f147618ddffcc69e5f1a81ae8c7fc83a84f/legalcase/case_operations.py#L63" +vendored = false +host = "github" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +relpath = "legalcase/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "legalcase/case_operations.py" +function = "case_bundle_thaw_181" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-legal-case-django-case-operations-case-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-79" +commit = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +parent = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django/blob/de226f147618ddffcc69e5f1a81ae8c7fc83a84f/legalcase/case_operations.py#L28" +vendored = false +host = "github" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "legalcase/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "legalcase/case_operations.py" +function = "case_caption_fold_076" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch--2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-502" +commit = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +parent = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/blob/5bafe528a2a15f3e4dbf87aaa0eae79d3421957c/backend/app/dispatch_operations.py#L51" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "backend/app/dispatch_operations.py" +function = "dispatch_bundle_thaw_182" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch-ope" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-601" +commit = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +parent = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/blob/5bafe528a2a15f3e4dbf87aaa0eae79d3421957c/backend/app/dispatch_operations.py#L38" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/dispatch_operations.py" +function = "dispatch_donecard_081" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-marketplace-commerce-fastapi-seller--2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-79" +commit = "f28971a8e0784652f9d9ef0515e38da025a0579b" +parent = "f28971a8e0784652f9d9ef0515e38da025a0579b" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/blob/f28971a8e0784652f9d9ef0515e38da025a0579b/backend/app/seller_operations.py#L73" +vendored = false +host = "github" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 73 +fix_line = 16 +relpath = "backend/app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "backend/app/seller_operations.py" +function = "seller_blurb_tile_328" +mechanism = "source_reaches_sink" +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-marketplace-commerce-fastapi-seller-ope" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-601" +commit = "f28971a8e0784652f9d9ef0515e38da025a0579b" +parent = "f28971a8e0784652f9d9ef0515e38da025a0579b" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/blob/f28971a8e0784652f9d9ef0515e38da025a0579b/backend/app/seller_operations.py#L43" +vendored = false +host = "github" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +relpath = "backend/app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/seller_operations.py" +function = "seller_return_lane_158" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-property-management-fastapi-tenant-o-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-22" +commit = "c6a51861f929524350f521407ddcf9683cca5fa8" +parent = "c6a51861f929524350f521407ddcf9683cca5fa8" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi/blob/c6a51861f929524350f521407ddcf9683cca5fa8/backend/app/tenant_operations.py#L29" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "backend/app/tenant_operations.py" +function = "tenant_boxfile_pull_086" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-property-management-fastapi-tenant-oper" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-639" +commit = "c6a51861f929524350f521407ddcf9683cca5fa8" +parent = "c6a51861f929524350f521407ddcf9683cca5fa8" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi/blob/c6a51861f929524350f521407ddcf9683cca5fa8/backend/app/tenant_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "backend/app/tenant_operations.py" +function = "lease_fold_card_085" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-support-desk-fastapi-support-operati-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-601" +commit = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +parent = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi/blob/b9839d7a1a4fd1f53366bfb24ec110da4699a8d3/app/support_operations.py#L41" +vendored = false +host = "github" +path = "app/support_operations.py" +fix_path = "app/support_operations.py" +mode = "enclosing" +line = 41 +fix_line = 16 +relpath = "app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "app/support_operations.py" +function = "ticket_return_lane_160" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-high-seeded-v2-support-desk-fastapi-support-operations" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-79" +commit = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +parent = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi/blob/b9839d7a1a4fd1f53366bfb24ec110da4699a8d3/app/support_operations.py#L23" +vendored = false +host = "github" +path = "app/support_operations.py" +fix_path = "app/support_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "app/support_operations.py" +function = "ticket_bannerlet_088" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-crm-saas-django-partner-console-account-wayb" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-601" +commit = "a9d2999ec12c7eac3176d1702544073d283c51bf" +parent = "a9d2999ec12c7eac3176d1702544073d283c51bf" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django/blob/a9d2999ec12c7eac3176d1702544073d283c51bf/crm_platform/partner_console.py#L46" +vendored = false +host = "github" +path = "crm_platform/partner_console.py" +fix_path = "crm_platform/partner_console.py" +mode = "enclosing" +line = 46 +fix_line = 19 +relpath = "crm_platform/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "crm_platform/partner_console.py" +function = "account_wayback_card_033" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-crm-saas-django-partner-console-acct-bundle-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-502" +commit = "a9d2999ec12c7eac3176d1702544073d283c51bf" +parent = "a9d2999ec12c7eac3176d1702544073d283c51bf" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django/blob/a9d2999ec12c7eac3176d1702544073d283c51bf/crm_platform/partner_console.py#L65" +vendored = false +host = "github" +path = "crm_platform/partner_console.py" +fix_path = "crm_platform/partner_console.py" +mode = "enclosing" +line = 65 +fix_line = 19 +relpath = "crm_platform/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "crm_platform/partner_console.py" +function = "acct_bundle_thaw_174" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-education-lms-django-course-operations-co-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-502" +commit = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +parent = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-education-lms-django/blob/49ca6b6f8fde8bcf3b782fb84afe7553586561e1/config/course_operations.py#L60" +vendored = false +host = "github" +path = "config/course_operations.py" +fix_path = "config/course_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +relpath = "config/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "config/course_operations.py" +function = "course_bundle_thaw_175" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-education-lms-django-course-operations-cours" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-601" +commit = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +parent = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-education-lms-django/blob/49ca6b6f8fde8bcf3b782fb84afe7553586561e1/config/course_operations.py#L54" +vendored = false +host = "github" +path = "config/course_operations.py" +fix_path = "config/course_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +relpath = "config/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "config/course_operations.py" +function = "course_return_lane_151" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-fintech-lending-fastapi-loan-operations-l-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-22" +commit = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +parent = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi/blob/0c90e57a9f436aab02184b6f056bb4d66cde34f0/backend/app/loan_operations.py#L29" +vendored = false +host = "github" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +relpath = "backend/app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "backend/app/loan_operations.py" +function = "loan_packlet_pull_038" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-fintech-lending-fastapi-loan-operations-loan" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-639" +commit = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +parent = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi/blob/0c90e57a9f436aab02184b6f056bb4d66cde34f0/backend/app/loan_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "backend/app/loan_operations.py" +function = "loan_queue_marker_037" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-healthcare-clinic-django-patient-operatio-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-601" +commit = "8512a7e9297ec9c2655a0969391630fcc23924fe" +parent = "8512a7e9297ec9c2655a0969391630fcc23924fe" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django/blob/8512a7e9297ec9c2655a0969391630fcc23924fe/clinic_project/patient_operations.py#L63" +vendored = false +host = "github" +path = "clinic_project/patient_operations.py" +fix_path = "clinic_project/patient_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +relpath = "clinic_project/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "clinic_project/patient_operations.py" +function = "patient_return_lane_155" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-healthcare-clinic-django-patient-operations-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-79" +commit = "8512a7e9297ec9c2655a0969391630fcc23924fe" +parent = "8512a7e9297ec9c2655a0969391630fcc23924fe" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django/blob/8512a7e9297ec9c2655a0969391630fcc23924fe/clinic_project/patient_operations.py#L28" +vendored = false +host = "github" +path = "clinic_project/patient_operations.py" +fix_path = "clinic_project/patient_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "clinic_project/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "clinic_project/patient_operations.py" +function = "patient_notelet_card_040" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-hr-payroll-django-payroll-operations-payr-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-502" +commit = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +parent = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django/blob/5726053dc9825b59c7a7dd91c3d13b788e2860c5/config/payroll_operations.py#L65" +vendored = false +host = "github" +path = "config/payroll_operations.py" +fix_path = "config/payroll_operations.py" +mode = "enclosing" +line = 65 +fix_line = 19 +relpath = "config/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "config/payroll_operations.py" +function = "payroll_bundle_thaw_176" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-hr-payroll-django-payroll-operations-payroll" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-601" +commit = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +parent = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django/blob/5726053dc9825b59c7a7dd91c3d13b788e2860c5/config/payroll_operations.py#L46" +vendored = false +host = "github" +path = "config/payroll_operations.py" +fix_path = "config/payroll_operations.py" +mode = "enclosing" +line = 46 +fix_line = 19 +relpath = "config/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "config/payroll_operations.py" +function = "payroll_done_lane_045" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-legal-case-django-case-operations-case-bundl" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-502" +commit = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +parent = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-legal-case-django/blob/3326f08f6c08f1a086d5a8f818c4dd6fdee947f4/legalcase/case_operations.py#L60" +vendored = false +host = "github" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +relpath = "legalcase/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "legalcase/case_operations.py" +function = "case_bundle_thaw_177" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-legal-case-django-case-operations-case-retur" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-601" +commit = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +parent = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-legal-case-django/blob/3326f08f6c08f1a086d5a8f818c4dd6fdee947f4/legalcase/case_operations.py#L54" +vendored = false +host = "github" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +relpath = "legalcase/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "legalcase/case_operations.py" +function = "case_return_lane_152" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-opera-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-22" +commit = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +parent = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi/blob/f4f3d452f8de0f83032fd1a5800eda7ea498231f/backend/app/dispatch_operations.py#L29" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "backend/app/dispatch_operations.py" +function = "dispatch_cargo_slot_050" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-operatio" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-639" +commit = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +parent = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi/blob/f4f3d452f8de0f83032fd1a5800eda7ea498231f/backend/app/dispatch_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "backend/app/dispatch_operations.py" +function = "dispatch_lane_card_049" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-marketplace-commerce-fastapi-seller-opera-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-79" +commit = "f81299ccd8490514e640c670f48b7af3f4415b48" +parent = "f81299ccd8490514e640c670f48b7af3f4415b48" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi/blob/f81299ccd8490514e640c670f48b7af3f4415b48/app/seller_operations.py#L76" +vendored = false +host = "github" +path = "app/seller_operations.py" +fix_path = "app/seller_operations.py" +mode = "enclosing" +line = 76 +fix_line = 16 +relpath = "app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "app/seller_operations.py" +function = "seller_blurb_tile_324" +mechanism = "source_reaches_sink" +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-marketplace-commerce-fastapi-seller-operatio" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-79" +commit = "f81299ccd8490514e640c670f48b7af3f4415b48" +parent = "f81299ccd8490514e640c670f48b7af3f4415b48" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi/blob/f81299ccd8490514e640c670f48b7af3f4415b48/app/seller_operations.py#L23" +vendored = false +host = "github" +path = "app/seller_operations.py" +fix_path = "app/seller_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "app/seller_operations.py" +function = "seller_pitch_tile_052" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-property-management-fastapi-tenant-operat-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-502" +commit = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +parent = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi/blob/1c3dad8c5deeb0be75524b793a4f6bd80515d619/backend/app/tenant_operations.py#L42" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 42 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "backend/app/tenant_operations.py" +function = "tenant_bundle_thaw_173" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-property-management-fastapi-tenant-operation" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-601" +commit = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +parent = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi/blob/1c3dad8c5deeb0be75524b793a4f6bd80515d619/backend/app/tenant_operations.py#L38" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/tenant_operations.py" +function = "tenant_exit_lane_057" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-support-desk-fastapi-support-operations-t-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-942" +commit = "5b8ce483d02f1fa6af678482972d92a2060491e1" +parent = "5b8ce483d02f1fa6af678482972d92a2060491e1" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi/blob/5b8ce483d02f1fa6af678482972d92a2060491e1/backend/app/support_operations.py#L80" +vendored = false +host = "github" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 80 +fix_line = 16 +relpath = "backend/app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-942" +class = "security_misconfiguration" +path = "backend/app/support_operations.py" +function = "ticket_origin_mirror_465" +mechanism = "permissive_default" +evidence = "Origin mirror reflects arbitrary request origins while allowing credentials. Seeded during v2-campaign-3 and approved for RealVuln GT enhancement." + +[[pair]] +name = "codex-seeded-v2-support-desk-fastapi-support-operations-tick" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-601" +commit = "5b8ce483d02f1fa6af678482972d92a2060491e1" +parent = "5b8ce483d02f1fa6af678482972d92a2060491e1" +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi/blob/5b8ce483d02f1fa6af678482972d92a2060491e1/backend/app/support_operations.py#L43" +vendored = false +host = "github" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +relpath = "backend/app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/support_operations.py" +function = "ticket_return_lane_153" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + [[pair]] name = "damn-vulnerable-graphql-application-views-mutate" slice = "vibe-py" @@ -467,6 +2507,686 @@ function = "validate_token" mechanism = "source_reaches_sink" evidence = "SQL injection via f-string interpolation of user-supplied registration code directly into a raw SQL query: text(f\"SELECT id, code FROM ... WHERE code = '{code}'\"). An attacker can inject arbitrary SQL through the registration_code form fiel" +[[pair]] +name = "kimi-code-seeded-v2-crm-saas-django-partner-console-account-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-601" +commit = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +parent = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django/blob/3081fae3cb2fda831a3e71dfce4fa9a023bdcc38/crm/core/partner_console.py#L46" +vendored = false +host = "github" +path = "crm/core/partner_console.py" +fix_path = "crm/core/partner_console.py" +mode = "enclosing" +line = 46 +fix_line = 19 +relpath = "crm/core/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "crm/core/partner_console.py" +function = "account_return_lane_093" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-crm-saas-django-partner-console-acct-bun" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django" +cve = "" +cwe = "CWE-502" +commit = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +parent = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django/blob/3081fae3cb2fda831a3e71dfce4fa9a023bdcc38/crm/core/partner_console.py#L65" +vendored = false +host = "github" +path = "crm/core/partner_console.py" +fix_path = "crm/core/partner_console.py" +mode = "enclosing" +line = 65 +fix_line = 19 +relpath = "crm/core/partner_console.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "crm/core/partner_console.py" +function = "acct_bundle_thaw_184" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-education-lms-django-course-operation-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-502" +commit = "877530d71e44a071dd6e203de09fe014c689b443" +parent = "877530d71e44a071dd6e203de09fe014c689b443" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django/blob/877530d71e44a071dd6e203de09fe014c689b443/lms/course_operations.py#L60" +vendored = false +host = "github" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +relpath = "lms/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "lms/course_operations.py" +function = "course_bundle_thaw_185" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-education-lms-django-course-operations-c" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django" +cve = "" +cwe = "CWE-601" +commit = "877530d71e44a071dd6e203de09fe014c689b443" +parent = "877530d71e44a071dd6e203de09fe014c689b443" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django/blob/877530d71e44a071dd6e203de09fe014c689b443/lms/course_operations.py#L54" +vendored = false +host = "github" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +relpath = "lms/course_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "lms/course_operations.py" +function = "course_return_lane_163" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operatio-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-22" +commit = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +parent = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi/blob/50a3098d1779c4fc1c71d5fe5253566f59b6f9f6/backend/app/loan_operations.py#L29" +vendored = false +host = "github" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +relpath = "backend/app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "backend/app/loan_operations.py" +function = "loan_stash_card_098" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operations-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi" +cve = "" +cwe = "CWE-639" +commit = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +parent = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi/blob/50a3098d1779c4fc1c71d5fe5253566f59b6f9f6/backend/app/loan_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/loan_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "backend/app/loan_operations.py" +function = "lendfolio_marker_097" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-healthcare-clinic-django-patient-oper-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-601" +commit = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +parent = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django/blob/f6ac3e39f83fa5b5bab27c5662b658713891e3fc/clinic_portal/patient_operations.py#L63" +vendored = false +host = "github" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +relpath = "clinic_portal/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "clinic_portal/patient_operations.py" +function = "patient_return_lane_167" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-healthcare-clinic-django-patient-operati" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django" +cve = "" +cwe = "CWE-79" +commit = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +parent = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django/blob/f6ac3e39f83fa5b5bab27c5662b658713891e3fc/clinic_portal/patient_operations.py#L28" +vendored = false +host = "github" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +relpath = "clinic_portal/patient_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "clinic_portal/patient_operations.py" +function = "patient_copy_tile_100" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-hr-payroll-django-payroll-operations--2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-502" +commit = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +parent = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django/blob/5a2a6d42919c9f991490ffb0bcbe75108371fe2c/hr_payroll/payroll_operations.py#L65" +vendored = false +host = "github" +path = "hr_payroll/payroll_operations.py" +fix_path = "hr_payroll/payroll_operations.py" +mode = "enclosing" +line = 65 +fix_line = 19 +relpath = "hr_payroll/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "hr_payroll/payroll_operations.py" +function = "payroll_bundle_thaw_186" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-hr-payroll-django-payroll-operations-pay" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django" +cve = "" +cwe = "CWE-601" +commit = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +parent = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django/blob/5a2a6d42919c9f991490ffb0bcbe75108371fe2c/hr_payroll/payroll_operations.py#L46" +vendored = false +host = "github" +path = "hr_payroll/payroll_operations.py" +fix_path = "hr_payroll/payroll_operations.py" +mode = "enclosing" +line = 46 +fix_line = 19 +relpath = "hr_payroll/payroll_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "hr_payroll/payroll_operations.py" +function = "payroll_wayback_card_105" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-legal-case-django-case-operations-case-b" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-502" +commit = "e19d28f7519ba75706770e22770fdac537f4a4de" +parent = "e19d28f7519ba75706770e22770fdac537f4a4de" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django/blob/e19d28f7519ba75706770e22770fdac537f4a4de/legalcase/case_operations.py#L60" +vendored = false +host = "github" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +relpath = "legalcase/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "legalcase/case_operations.py" +function = "case_bundle_thaw_187" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-legal-case-django-case-operations-case-r" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django" +cve = "" +cwe = "CWE-601" +commit = "e19d28f7519ba75706770e22770fdac537f4a4de" +parent = "e19d28f7519ba75706770e22770fdac537f4a4de" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django/blob/e19d28f7519ba75706770e22770fdac537f4a4de/legalcase/case_operations.py#L54" +vendored = false +host = "github" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +relpath = "legalcase/case_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "legalcase/case_operations.py" +function = "case_return_lane_164" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-o-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-22" +commit = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +parent = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/blob/e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb/backend/app/dispatch_operations.py#L29" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-22" +class = "path_traversal" +path = "backend/app/dispatch_operations.py" +function = "dispatch_manifest_pull_110" +mechanism = "path_join_user_input" +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-oper" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi" +cve = "" +cwe = "CWE-639" +commit = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +parent = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/blob/e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb/backend/app/dispatch_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/dispatch_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-639" +class = "idor" +path = "backend/app/dispatch_operations.py" +function = "routeband_card_109" +mechanism = "identity_from_request_body" +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-o-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-79" +commit = "065ef1ebaea854b3f2575db9a93f08313729aa09" +parent = "065ef1ebaea854b3f2575db9a93f08313729aa09" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/blob/065ef1ebaea854b3f2575db9a93f08313729aa09/backend/app/seller_operations.py#L79" +vendored = false +host = "github" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 79 +fix_line = 16 +relpath = "backend/app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "backend/app/seller_operations.py" +function = "seller_blurb_tile_332" +mechanism = "source_reaches_sink" +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-oper" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi" +cve = "" +cwe = "CWE-79" +commit = "065ef1ebaea854b3f2575db9a93f08313729aa09" +parent = "065ef1ebaea854b3f2575db9a93f08313729aa09" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/blob/065ef1ebaea854b3f2575db9a93f08313729aa09/backend/app/seller_operations.py#L23" +vendored = false +host = "github" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +relpath = "backend/app/seller_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "backend/app/seller_operations.py" +function = "seller_blurb_card_112" +mechanism = "source_reaches_sink" +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-property-management-fastapi-tenant-op-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-502" +commit = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +parent = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi/blob/0048d045bc53534d7da5ef1bdf1c25072cfb3374/backend/app/tenant_operations.py#L42" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 42 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure_deserialization" +path = "backend/app/tenant_operations.py" +function = "tenant_bundle_thaw_183" +mechanism = "source_reaches_sink" +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-property-management-fastapi-tenant-opera" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi" +cve = "" +cwe = "CWE-601" +commit = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +parent = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi/blob/0048d045bc53534d7da5ef1bdf1c25072cfb3374/backend/app/tenant_operations.py#L38" +vendored = false +host = "github" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +relpath = "backend/app/tenant_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/tenant_operations.py" +function = "tenant_afterlane_117" +mechanism = "source_reaches_sink" +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-support-desk-fastapi-support-operatio-2" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-79" +commit = "76776570d1ff3607277ca2b1af2546b362d6e65b" +parent = "76776570d1ff3607277ca2b1af2546b362d6e65b" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi/blob/76776570d1ff3607277ca2b1af2546b362d6e65b/backend/app/support_operations.py#L68" +vendored = false +host = "github" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 68 +fix_line = 16 +relpath = "backend/app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "holdout" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-79" +class = "reflected_xss" +path = "backend/app/support_operations.py" +function = "ticket_blurb_tile_329" +mechanism = "source_reaches_sink" +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + +[[pair]] +name = "kimi-code-seeded-v2-support-desk-fastapi-support-operations-" +slice = "vibe-py" +language = "python" +origin = "real-vuln-benchmark" +license = "unlicensed" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi" +cve = "" +cwe = "CWE-601" +commit = "76776570d1ff3607277ca2b1af2546b362d6e65b" +parent = "76776570d1ff3607277ca2b1af2546b362d6e65b" +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi/blob/76776570d1ff3607277ca2b1af2546b362d6e65b/backend/app/support_operations.py#L43" +vendored = false +host = "github" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +relpath = "backend/app/support_operations.py" +min_recall = 1.0 +fix_policy = "silent" +provenance = "agent" +split = "train" +review_tier = "seeded" + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "backend/app/support_operations.py" +function = "ticket_return_lane_165" +mechanism = "source_reaches_sink" +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." + [[pair]] name = "python-insecure-app-main-try-hack-me" slice = "vibe-py" diff --git a/benchmarks/pairs/vibe-py/recipes.toml b/benchmarks/pairs/vibe-py/recipes.toml index 53dc4e5..66ffd62 100644 --- a/benchmarks/pairs/vibe-py/recipes.toml +++ b/benchmarks/pairs/vibe-py/recipes.toml @@ -2,6 +2,1986 @@ # Vulnerable function = vuln side; a false-positive trap from the same repo = fixed twin. # Review each row before trusting it as a label; regenerate with build_recipes.py. +[[recipe]] +name = "claude-code-seeded-v2-crm-saas-django-partner-console-acct-p" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django" +parent = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +commit = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +path = "crm_project/partner_console.py" +fix_path = "crm_project/partner_console.py" +mode = "enclosing" +line = 36 +fix_line = 19 +function = "acct_packet_pull_002" +language = "python" +relpath = "crm_project/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-002" +trap_id = "vc-claude-code-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django/blob/5deee4e20becf5fa4193ce4e68f9e736a3d048c9/crm_project/partner_console.py#L36" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-crm-saas-django-partner-console-acct-r" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django" +parent = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +commit = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9" +path = "crm_project/partner_console.py" +fix_path = "crm_project/partner_console.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "acct_roster_card_001" +language = "python" +relpath = "crm_project/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-001" +trap_id = "vc-claude-code-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django/blob/5deee4e20becf5fa4193ce4e68f9e736a3d048c9/crm_project/partner_console.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-education-lms-django-course-operati-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django" +parent = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +commit = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +function = "course_return_lane_150" +language = "python" +relpath = "lms/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-150" +trap_id = "vc-claude-code-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django/blob/e4dfb85400f8747ea0418e1f48e65fdef678a96a/lms/course_operations.py#L63" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-education-lms-django-course-operations" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django" +parent = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +commit = "e4dfb85400f8747ea0418e1f48e65fdef678a96a" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "course_blurb_card_004" +language = "python" +relpath = "lms/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-004" +trap_id = "vc-claude-code-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django/blob/e4dfb85400f8747ea0418e1f48e65fdef678a96a/lms/course_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-fintech-lending-fastapi-loan-operat-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi" +parent = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +commit = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +function = "loan_bundle_thaw_168" +language = "python" +relpath = "backend/app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-168" +trap_id = "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi/blob/d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64/backend/app/loan_operations.py#L51" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-fintech-lending-fastapi-loan-operation" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi" +parent = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +commit = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +function = "loan_return_lane_009" +language = "python" +relpath = "backend/app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-009" +trap_id = "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi/blob/d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64/backend/app/loan_operations.py#L38" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-healthcare-clinic-django-patient-op-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django" +parent = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +commit = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +function = "patient_bundle_thaw_169" +language = "python" +relpath = "clinic_portal/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-169" +trap_id = "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django/blob/48c7195d18089f77e3d3d9e197c6a2862c2798e0/clinic_portal/patient_operations.py#L60" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-healthcare-clinic-django-patient-opera" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django" +parent = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +commit = "48c7195d18089f77e3d3d9e197c6a2862c2798e0" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +function = "patient_return_lane_145" +language = "python" +relpath = "clinic_portal/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-145" +trap_id = "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django/blob/48c7195d18089f77e3d3d9e197c6a2862c2798e0/clinic_portal/patient_operations.py#L54" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-hr-payroll-django-payroll-operation-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django" +parent = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +commit = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 36 +fix_line = 19 +function = "payroll_fold_drop_014" +language = "python" +relpath = "hr_portal/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-014" +trap_id = "vc-claude-code-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django/blob/bdd60d0f8896af0f77a628d8ebe8fa24fa385d56/hr_portal/payroll_operations.py#L36" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-hr-payroll-django-payroll-operations-p" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django" +parent = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +commit = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "payroll_rollcard_013" +language = "python" +relpath = "hr_portal/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-013" +trap_id = "vc-claude-code-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django/blob/bdd60d0f8896af0f77a628d8ebe8fa24fa385d56/hr_portal/payroll_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-legal-case-django-case-operations-c-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django" +parent = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +commit = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +path = "legal_firm/case_operations.py" +fix_path = "legal_firm/case_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +function = "case_bundle_thaw_171" +language = "python" +relpath = "legal_firm/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-171" +trap_id = "vc-claude-code-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django/blob/3c38d4caf4386567c26bd136f5baddfeb51fc302/legal_firm/case_operations.py#L63" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-legal-case-django-case-operations-case" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django" +parent = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +commit = "3c38d4caf4386567c26bd136f5baddfeb51fc302" +path = "legal_firm/case_operations.py" +fix_path = "legal_firm/case_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "case_banner_fold_016" +language = "python" +relpath = "legal_firm/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-016" +trap_id = "vc-claude-code-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django/blob/3c38d4caf4386567c26bd136f5baddfeb51fc302/legal_firm/case_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi" +parent = "047e3a2471ed7c14793c19798c460882cb1d1de1" +commit = "047e3a2471ed7c14793c19798c460882cb1d1de1" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +function = "dispatch_bundle_thaw_172" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-172" +trap_id = "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/blob/047e3a2471ed7c14793c19798c460882cb1d1de1/backend/app/dispatch_operations.py#L51" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-op" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi" +parent = "047e3a2471ed7c14793c19798c460882cb1d1de1" +commit = "047e3a2471ed7c14793c19798c460882cb1d1de1" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +function = "dispatch_afterlane_021" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-021" +trap_id = "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/blob/047e3a2471ed7c14793c19798c460882cb1d1de1/backend/app/dispatch_operations.py#L38" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi" +parent = "2e8df4229d046364594b69e049f94d95e933e60d" +commit = "2e8df4229d046364594b69e049f94d95e933e60d" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 70 +fix_line = 16 +function = "seller_blurb_tile_321" +language = "python" +relpath = "backend/app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-321" +trap_id = "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/blob/2e8df4229d046364594b69e049f94d95e933e60d/backend/app/seller_operations.py#L70" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-op" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi" +parent = "2e8df4229d046364594b69e049f94d95e933e60d" +commit = "2e8df4229d046364594b69e049f94d95e933e60d" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +function = "seller_return_lane_146" +language = "python" +relpath = "backend/app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-146" +trap_id = "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/blob/2e8df4229d046364594b69e049f94d95e933e60d/backend/app/seller_operations.py#L43" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-property-management-fastapi-tenant--2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi" +parent = "001737a4c9f94ab57bec0635509b8a745a3d0482" +commit = "001737a4c9f94ab57bec0635509b8a745a3d0482" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +function = "lease_docu_slot_026" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-026" +trap_id = "vc-claude-code-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi/blob/001737a4c9f94ab57bec0635509b8a745a3d0482/backend/app/tenant_operations.py#L29" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-property-management-fastapi-tenant-ope" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi" +parent = "001737a4c9f94ab57bec0635509b8a745a3d0482" +commit = "001737a4c9f94ab57bec0635509b8a745a3d0482" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "tenant_ledger_tile_025" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-025" +trap_id = "vc-claude-code-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi/blob/001737a4c9f94ab57bec0635509b8a745a3d0482/backend/app/tenant_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "claude-code-seeded-v2-support-desk-fastapi-support-operat-2" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi" +parent = "837945410ef4cbd1651e4d6d41f30bf61442e174" +commit = "837945410ef4cbd1651e4d6d41f30bf61442e174" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 41 +fix_line = 16 +function = "ticket_return_lane_148" +language = "python" +relpath = "backend/app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-148" +trap_id = "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi/blob/837945410ef4cbd1651e4d6d41f30bf61442e174/backend/app/support_operations.py#L41" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "claude-code-seeded-v2-support-desk-fastapi-support-operation" +host = "github" +repo = "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi" +parent = "837945410ef4cbd1651e4d6d41f30bf61442e174" +commit = "837945410ef4cbd1651e4d6d41f30bf61442e174" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "ticket_copy_badge_028" +language = "python" +relpath = "backend/app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-claude-code-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-028" +trap_id = "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi/blob/837945410ef4cbd1651e4d6d41f30bf61442e174/backend/app/support_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-crm-saas-django-partner-console-acct-fo" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django" +parent = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +commit = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +path = "config/partner_console.py" +fix_path = "config/partner_console.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "acct_folio_badge_061" +language = "python" +relpath = "config/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-061" +trap_id = "vc-codex-high-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django/blob/de186e3d9694f7d39579a6f8d0e40fe7d4d64784/config/partner_console.py#L28" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-crm-saas-django-partner-console-acct-va" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django" +parent = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +commit = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784" +path = "config/partner_console.py" +fix_path = "config/partner_console.py" +mode = "enclosing" +line = 36 +fix_line = 19 +function = "acct_vaultlet_pull_062" +language = "python" +relpath = "config/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-062" +trap_id = "vc-codex-high-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django/blob/de186e3d9694f7d39579a6f8d0e40fe7d4d64784/config/partner_console.py#L36" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-education-lms-django-course-operatio-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django" +parent = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +commit = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +path = "education_lms/course_operations.py" +fix_path = "education_lms/course_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +function = "course_return_lane_162" +language = "python" +relpath = "education_lms/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-162" +trap_id = "vc-codex-high-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django/blob/0a542ba3abbff8c2a8fbc5f9aa4d530d276582df/education_lms/course_operations.py#L63" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-education-lms-django-course-operations-" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django" +parent = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +commit = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df" +path = "education_lms/course_operations.py" +fix_path = "education_lms/course_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "course_memo_badge_064" +language = "python" +relpath = "education_lms/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-064" +trap_id = "vc-codex-high-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django/blob/0a542ba3abbff8c2a8fbc5f9aa4d530d276582df/education_lms/course_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-fintech-lending-fastapi-loan-operati-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi" +parent = "056336c2bf4e00df7864ab36290218fc6ede117d" +commit = "056336c2bf4e00df7864ab36290218fc6ede117d" +path = "app/loan_operations.py" +fix_path = "app/loan_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +function = "loan_bundle_thaw_178" +language = "python" +relpath = "app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-178" +trap_id = "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi/blob/056336c2bf4e00df7864ab36290218fc6ede117d/app/loan_operations.py#L51" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-fintech-lending-fastapi-loan-operations" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi" +parent = "056336c2bf4e00df7864ab36290218fc6ede117d" +commit = "056336c2bf4e00df7864ab36290218fc6ede117d" +path = "app/loan_operations.py" +fix_path = "app/loan_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +function = "loan_aftercard_069" +language = "python" +relpath = "app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-069" +trap_id = "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi/blob/056336c2bf4e00df7864ab36290218fc6ede117d/app/loan_operations.py#L38" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-healthcare-clinic-django-patient-ope-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django" +parent = "83ffa47b05666e0c9f462628540b2146ddf5055a" +commit = "83ffa47b05666e0c9f462628540b2146ddf5055a" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +function = "patient_bundle_thaw_179" +language = "python" +relpath = "clinic_portal/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-179" +trap_id = "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django/blob/83ffa47b05666e0c9f462628540b2146ddf5055a/clinic_portal/patient_operations.py#L60" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-healthcare-clinic-django-patient-operat" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django" +parent = "83ffa47b05666e0c9f462628540b2146ddf5055a" +commit = "83ffa47b05666e0c9f462628540b2146ddf5055a" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +function = "patient_return_lane_157" +language = "python" +relpath = "clinic_portal/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-157" +trap_id = "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django/blob/83ffa47b05666e0c9f462628540b2146ddf5055a/clinic_portal/patient_operations.py#L54" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-hr-payroll-django-payroll-operations-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django" +parent = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +commit = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 36 +fix_line = 19 +function = "payroll_zipper_note_074" +language = "python" +relpath = "hr_portal/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-074" +trap_id = "vc-codex-high-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django/blob/df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9/hr_portal/payroll_operations.py#L36" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-hr-payroll-django-payroll-operations-pa" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django" +parent = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +commit = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9" +path = "hr_portal/payroll_operations.py" +fix_path = "hr_portal/payroll_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "payroll_cycle_tile_073" +language = "python" +relpath = "hr_portal/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-073" +trap_id = "vc-codex-high-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django/blob/df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9/hr_portal/payroll_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-legal-case-django-case-operations-ca-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django" +parent = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +commit = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +function = "case_bundle_thaw_181" +language = "python" +relpath = "legalcase/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-181" +trap_id = "vc-codex-high-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django/blob/de226f147618ddffcc69e5f1a81ae8c7fc83a84f/legalcase/case_operations.py#L63" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-legal-case-django-case-operations-case-" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django" +parent = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +commit = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "case_caption_fold_076" +language = "python" +relpath = "legalcase/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-076" +trap_id = "vc-codex-high-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django/blob/de226f147618ddffcc69e5f1a81ae8c7fc83a84f/legalcase/case_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch--2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi" +parent = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +commit = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 51 +fix_line = 16 +function = "dispatch_bundle_thaw_182" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-182" +trap_id = "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/blob/5bafe528a2a15f3e4dbf87aaa0eae79d3421957c/backend/app/dispatch_operations.py#L51" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch-ope" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi" +parent = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +commit = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +function = "dispatch_donecard_081" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-081" +trap_id = "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/blob/5bafe528a2a15f3e4dbf87aaa0eae79d3421957c/backend/app/dispatch_operations.py#L38" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-marketplace-commerce-fastapi-seller--2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi" +parent = "f28971a8e0784652f9d9ef0515e38da025a0579b" +commit = "f28971a8e0784652f9d9ef0515e38da025a0579b" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 73 +fix_line = 16 +function = "seller_blurb_tile_328" +language = "python" +relpath = "backend/app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-328" +trap_id = "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/blob/f28971a8e0784652f9d9ef0515e38da025a0579b/backend/app/seller_operations.py#L73" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-marketplace-commerce-fastapi-seller-ope" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi" +parent = "f28971a8e0784652f9d9ef0515e38da025a0579b" +commit = "f28971a8e0784652f9d9ef0515e38da025a0579b" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +function = "seller_return_lane_158" +language = "python" +relpath = "backend/app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-158" +trap_id = "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/blob/f28971a8e0784652f9d9ef0515e38da025a0579b/backend/app/seller_operations.py#L43" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-property-management-fastapi-tenant-o-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi" +parent = "c6a51861f929524350f521407ddcf9683cca5fa8" +commit = "c6a51861f929524350f521407ddcf9683cca5fa8" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +function = "tenant_boxfile_pull_086" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-086" +trap_id = "vc-codex-high-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi/blob/c6a51861f929524350f521407ddcf9683cca5fa8/backend/app/tenant_operations.py#L29" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-property-management-fastapi-tenant-oper" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi" +parent = "c6a51861f929524350f521407ddcf9683cca5fa8" +commit = "c6a51861f929524350f521407ddcf9683cca5fa8" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "lease_fold_card_085" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-085" +trap_id = "vc-codex-high-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi/blob/c6a51861f929524350f521407ddcf9683cca5fa8/backend/app/tenant_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-high-seeded-v2-support-desk-fastapi-support-operati-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi" +parent = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +commit = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +path = "app/support_operations.py" +fix_path = "app/support_operations.py" +mode = "enclosing" +line = 41 +fix_line = 16 +function = "ticket_return_lane_160" +language = "python" +relpath = "app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-160" +trap_id = "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi/blob/b9839d7a1a4fd1f53366bfb24ec110da4699a8d3/app/support_operations.py#L41" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-high-seeded-v2-support-desk-fastapi-support-operations" +host = "github" +repo = "kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi" +parent = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +commit = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3" +path = "app/support_operations.py" +fix_path = "app/support_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "ticket_bannerlet_088" +language = "python" +relpath = "app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-high-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-088" +trap_id = "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi/blob/b9839d7a1a4fd1f53366bfb24ec110da4699a8d3/app/support_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-crm-saas-django-partner-console-account-wayb" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django" +parent = "a9d2999ec12c7eac3176d1702544073d283c51bf" +commit = "a9d2999ec12c7eac3176d1702544073d283c51bf" +path = "crm_platform/partner_console.py" +fix_path = "crm_platform/partner_console.py" +mode = "enclosing" +line = 46 +fix_line = 19 +function = "account_wayback_card_033" +language = "python" +relpath = "crm_platform/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-033" +trap_id = "vc-codex-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django/blob/a9d2999ec12c7eac3176d1702544073d283c51bf/crm_platform/partner_console.py#L46" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-crm-saas-django-partner-console-acct-bundle-" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django" +parent = "a9d2999ec12c7eac3176d1702544073d283c51bf" +commit = "a9d2999ec12c7eac3176d1702544073d283c51bf" +path = "crm_platform/partner_console.py" +fix_path = "crm_platform/partner_console.py" +mode = "enclosing" +line = 65 +fix_line = 19 +function = "acct_bundle_thaw_174" +language = "python" +relpath = "crm_platform/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-174" +trap_id = "vc-codex-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django/blob/a9d2999ec12c7eac3176d1702544073d283c51bf/crm_platform/partner_console.py#L65" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-education-lms-django-course-operations-co-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-education-lms-django" +parent = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +commit = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +path = "config/course_operations.py" +fix_path = "config/course_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +function = "course_bundle_thaw_175" +language = "python" +relpath = "config/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-175" +trap_id = "vc-codex-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-education-lms-django/blob/49ca6b6f8fde8bcf3b782fb84afe7553586561e1/config/course_operations.py#L60" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-education-lms-django-course-operations-cours" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-education-lms-django" +parent = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +commit = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1" +path = "config/course_operations.py" +fix_path = "config/course_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +function = "course_return_lane_151" +language = "python" +relpath = "config/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-151" +trap_id = "vc-codex-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-education-lms-django/blob/49ca6b6f8fde8bcf3b782fb84afe7553586561e1/config/course_operations.py#L54" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-fintech-lending-fastapi-loan-operations-l-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi" +parent = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +commit = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +function = "loan_packlet_pull_038" +language = "python" +relpath = "backend/app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-038" +trap_id = "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi/blob/0c90e57a9f436aab02184b6f056bb4d66cde34f0/backend/app/loan_operations.py#L29" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-fintech-lending-fastapi-loan-operations-loan" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi" +parent = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +commit = "0c90e57a9f436aab02184b6f056bb4d66cde34f0" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "loan_queue_marker_037" +language = "python" +relpath = "backend/app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-037" +trap_id = "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi/blob/0c90e57a9f436aab02184b6f056bb4d66cde34f0/backend/app/loan_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-healthcare-clinic-django-patient-operatio-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django" +parent = "8512a7e9297ec9c2655a0969391630fcc23924fe" +commit = "8512a7e9297ec9c2655a0969391630fcc23924fe" +path = "clinic_project/patient_operations.py" +fix_path = "clinic_project/patient_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +function = "patient_return_lane_155" +language = "python" +relpath = "clinic_project/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-155" +trap_id = "vc-codex-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django/blob/8512a7e9297ec9c2655a0969391630fcc23924fe/clinic_project/patient_operations.py#L63" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-healthcare-clinic-django-patient-operations-" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django" +parent = "8512a7e9297ec9c2655a0969391630fcc23924fe" +commit = "8512a7e9297ec9c2655a0969391630fcc23924fe" +path = "clinic_project/patient_operations.py" +fix_path = "clinic_project/patient_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "patient_notelet_card_040" +language = "python" +relpath = "clinic_project/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-040" +trap_id = "vc-codex-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django/blob/8512a7e9297ec9c2655a0969391630fcc23924fe/clinic_project/patient_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-hr-payroll-django-payroll-operations-payr-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django" +parent = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +commit = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +path = "config/payroll_operations.py" +fix_path = "config/payroll_operations.py" +mode = "enclosing" +line = 65 +fix_line = 19 +function = "payroll_bundle_thaw_176" +language = "python" +relpath = "config/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-176" +trap_id = "vc-codex-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django/blob/5726053dc9825b59c7a7dd91c3d13b788e2860c5/config/payroll_operations.py#L65" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-hr-payroll-django-payroll-operations-payroll" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django" +parent = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +commit = "5726053dc9825b59c7a7dd91c3d13b788e2860c5" +path = "config/payroll_operations.py" +fix_path = "config/payroll_operations.py" +mode = "enclosing" +line = 46 +fix_line = 19 +function = "payroll_done_lane_045" +language = "python" +relpath = "config/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-045" +trap_id = "vc-codex-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django/blob/5726053dc9825b59c7a7dd91c3d13b788e2860c5/config/payroll_operations.py#L46" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-legal-case-django-case-operations-case-bundl" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django" +parent = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +commit = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +function = "case_bundle_thaw_177" +language = "python" +relpath = "legalcase/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-177" +trap_id = "vc-codex-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-legal-case-django/blob/3326f08f6c08f1a086d5a8f818c4dd6fdee947f4/legalcase/case_operations.py#L60" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-legal-case-django-case-operations-case-retur" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django" +parent = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +commit = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +function = "case_return_lane_152" +language = "python" +relpath = "legalcase/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-152" +trap_id = "vc-codex-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-legal-case-django/blob/3326f08f6c08f1a086d5a8f818c4dd6fdee947f4/legalcase/case_operations.py#L54" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-opera-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi" +parent = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +commit = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +function = "dispatch_cargo_slot_050" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-050" +trap_id = "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi/blob/f4f3d452f8de0f83032fd1a5800eda7ea498231f/backend/app/dispatch_operations.py#L29" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-operatio" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi" +parent = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +commit = "f4f3d452f8de0f83032fd1a5800eda7ea498231f" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "dispatch_lane_card_049" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-049" +trap_id = "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi/blob/f4f3d452f8de0f83032fd1a5800eda7ea498231f/backend/app/dispatch_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-marketplace-commerce-fastapi-seller-opera-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi" +parent = "f81299ccd8490514e640c670f48b7af3f4415b48" +commit = "f81299ccd8490514e640c670f48b7af3f4415b48" +path = "app/seller_operations.py" +fix_path = "app/seller_operations.py" +mode = "enclosing" +line = 76 +fix_line = 16 +function = "seller_blurb_tile_324" +language = "python" +relpath = "app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-324" +trap_id = "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi/blob/f81299ccd8490514e640c670f48b7af3f4415b48/app/seller_operations.py#L76" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-marketplace-commerce-fastapi-seller-operatio" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi" +parent = "f81299ccd8490514e640c670f48b7af3f4415b48" +commit = "f81299ccd8490514e640c670f48b7af3f4415b48" +path = "app/seller_operations.py" +fix_path = "app/seller_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "seller_pitch_tile_052" +language = "python" +relpath = "app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-052" +trap_id = "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi/blob/f81299ccd8490514e640c670f48b7af3f4415b48/app/seller_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-property-management-fastapi-tenant-operat-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi" +parent = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +commit = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 42 +fix_line = 16 +function = "tenant_bundle_thaw_173" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-173" +trap_id = "vc-codex-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi/blob/1c3dad8c5deeb0be75524b793a4f6bd80515d619/backend/app/tenant_operations.py#L42" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-property-management-fastapi-tenant-operation" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi" +parent = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +commit = "1c3dad8c5deeb0be75524b793a4f6bd80515d619" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +function = "tenant_exit_lane_057" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-057" +trap_id = "vc-codex-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi/blob/1c3dad8c5deeb0be75524b793a4f6bd80515d619/backend/app/tenant_operations.py#L38" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "codex-seeded-v2-support-desk-fastapi-support-operations-t-2" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi" +parent = "5b8ce483d02f1fa6af678482972d92a2060491e1" +commit = "5b8ce483d02f1fa6af678482972d92a2060491e1" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 80 +fix_line = 16 +function = "ticket_origin_mirror_465" +language = "python" +relpath = "backend/app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-942" +class = "security_misconfiguration" +mechanism = "permissive_default" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-3-465" +trap_id = "vc-codex-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-942", "CWE-16", "CWE-346", "CWE-284"] +evidence = "Origin mirror reflects arbitrary request origins while allowing credentials. Seeded during v2-campaign-3 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi/blob/5b8ce483d02f1fa6af678482972d92a2060491e1/backend/app/support_operations.py#L80" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "codex-seeded-v2-support-desk-fastapi-support-operations-tick" +host = "github" +repo = "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi" +parent = "5b8ce483d02f1fa6af678482972d92a2060491e1" +commit = "5b8ce483d02f1fa6af678482972d92a2060491e1" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +function = "ticket_return_lane_153" +language = "python" +relpath = "backend/app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-codex-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-153" +trap_id = "vc-codex-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi/blob/5b8ce483d02f1fa6af678482972d92a2060491e1/backend/app/support_operations.py#L43" +vendored = false +review_tier = "seeded" +split = "holdout" + [[recipe]] name = "damn-vulnerable-graphql-application-views-mutate" host = "github" @@ -498,6 +2478,666 @@ evidence = "SQL injection via f-string interpolation of user-supplied registrati commit_url = "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15" split = "holdout" +[[recipe]] +name = "kimi-code-seeded-v2-crm-saas-django-partner-console-account-" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django" +parent = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +commit = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +path = "crm/core/partner_console.py" +fix_path = "crm/core/partner_console.py" +mode = "enclosing" +line = 46 +fix_line = 19 +function = "account_return_lane_093" +language = "python" +relpath = "crm/core/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-093" +trap_id = "vc-kimi-code-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django/blob/3081fae3cb2fda831a3e71dfce4fa9a023bdcc38/crm/core/partner_console.py#L46" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-crm-saas-django-partner-console-acct-bun" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django" +parent = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +commit = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38" +path = "crm/core/partner_console.py" +fix_path = "crm/core/partner_console.py" +mode = "enclosing" +line = 65 +fix_line = 19 +function = "acct_bundle_thaw_184" +language = "python" +relpath = "crm/core/partner_console.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-crm-saas-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-184" +trap_id = "vc-kimi-code-seeded-v2-crm-saas-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django/blob/3081fae3cb2fda831a3e71dfce4fa9a023bdcc38/crm/core/partner_console.py#L65" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-education-lms-django-course-operation-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django" +parent = "877530d71e44a071dd6e203de09fe014c689b443" +commit = "877530d71e44a071dd6e203de09fe014c689b443" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +function = "course_bundle_thaw_185" +language = "python" +relpath = "lms/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-185" +trap_id = "vc-kimi-code-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django/blob/877530d71e44a071dd6e203de09fe014c689b443/lms/course_operations.py#L60" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-education-lms-django-course-operations-c" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django" +parent = "877530d71e44a071dd6e203de09fe014c689b443" +commit = "877530d71e44a071dd6e203de09fe014c689b443" +path = "lms/course_operations.py" +fix_path = "lms/course_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +function = "course_return_lane_163" +language = "python" +relpath = "lms/course_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-education-lms-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-163" +trap_id = "vc-kimi-code-seeded-v2-education-lms-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django/blob/877530d71e44a071dd6e203de09fe014c689b443/lms/course_operations.py#L54" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operatio-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi" +parent = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +commit = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +function = "loan_stash_card_098" +language = "python" +relpath = "backend/app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-098" +trap_id = "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi/blob/50a3098d1779c4fc1c71d5fe5253566f59b6f9f6/backend/app/loan_operations.py#L29" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operations-" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi" +parent = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +commit = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6" +path = "backend/app/loan_operations.py" +fix_path = "backend/app/loan_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "lendfolio_marker_097" +language = "python" +relpath = "backend/app/loan_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-fintech-lending-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-097" +trap_id = "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi/blob/50a3098d1779c4fc1c71d5fe5253566f59b6f9f6/backend/app/loan_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-healthcare-clinic-django-patient-oper-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django" +parent = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +commit = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 63 +fix_line = 19 +function = "patient_return_lane_167" +language = "python" +relpath = "clinic_portal/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-167" +trap_id = "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django/blob/f6ac3e39f83fa5b5bab27c5662b658713891e3fc/clinic_portal/patient_operations.py#L63" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-healthcare-clinic-django-patient-operati" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django" +parent = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +commit = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc" +path = "clinic_portal/patient_operations.py" +fix_path = "clinic_portal/patient_operations.py" +mode = "enclosing" +line = 28 +fix_line = 19 +function = "patient_copy_tile_100" +language = "python" +relpath = "clinic_portal/patient_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-healthcare-clinic-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-100" +trap_id = "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django/blob/f6ac3e39f83fa5b5bab27c5662b658713891e3fc/clinic_portal/patient_operations.py#L28" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-hr-payroll-django-payroll-operations--2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django" +parent = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +commit = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +path = "hr_payroll/payroll_operations.py" +fix_path = "hr_payroll/payroll_operations.py" +mode = "enclosing" +line = 65 +fix_line = 19 +function = "payroll_bundle_thaw_186" +language = "python" +relpath = "hr_payroll/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-186" +trap_id = "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django/blob/5a2a6d42919c9f991490ffb0bcbe75108371fe2c/hr_payroll/payroll_operations.py#L65" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-hr-payroll-django-payroll-operations-pay" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django" +parent = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +commit = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c" +path = "hr_payroll/payroll_operations.py" +fix_path = "hr_payroll/payroll_operations.py" +mode = "enclosing" +line = 46 +fix_line = 19 +function = "payroll_wayback_card_105" +language = "python" +relpath = "hr_payroll/payroll_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-hr-payroll-django" +framework = "django" +gt_id = "seeded-v2-campaign-1-105" +trap_id = "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django/blob/5a2a6d42919c9f991490ffb0bcbe75108371fe2c/hr_payroll/payroll_operations.py#L46" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-legal-case-django-case-operations-case-b" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django" +parent = "e19d28f7519ba75706770e22770fdac537f4a4de" +commit = "e19d28f7519ba75706770e22770fdac537f4a4de" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 60 +fix_line = 19 +function = "case_bundle_thaw_187" +language = "python" +relpath = "legalcase/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-187" +trap_id = "vc-kimi-code-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django/blob/e19d28f7519ba75706770e22770fdac537f4a4de/legalcase/case_operations.py#L60" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-legal-case-django-case-operations-case-r" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django" +parent = "e19d28f7519ba75706770e22770fdac537f4a4de" +commit = "e19d28f7519ba75706770e22770fdac537f4a4de" +path = "legalcase/case_operations.py" +fix_path = "legalcase/case_operations.py" +mode = "enclosing" +line = 54 +fix_line = 19 +function = "case_return_lane_164" +language = "python" +relpath = "legalcase/case_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-legal-case-django" +framework = "django" +gt_id = "seeded-v2-campaign-2-164" +trap_id = "vc-kimi-code-seeded-v2-legal-case-django-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django/blob/e19d28f7519ba75706770e22770fdac537f4a4de/legalcase/case_operations.py#L54" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-o-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi" +parent = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +commit = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 29 +fix_line = 16 +function = "dispatch_manifest_pull_110" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-22" +class = "path_traversal" +mechanism = "path_join_user_input" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-110" +trap_id = "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-22", "CWE-23", "CWE-36", "CWE-73"] +evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/blob/e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb/backend/app/dispatch_operations.py#L29" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-oper" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi" +parent = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +commit = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb" +path = "backend/app/dispatch_operations.py" +fix_path = "backend/app/dispatch_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "routeband_card_109" +language = "python" +relpath = "backend/app/dispatch_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-639" +class = "idor" +mechanism = "identity_from_request_body" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-109" +trap_id = "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001" +acceptable_cwes = ["CWE-639", "CWE-284", "CWE-862"] +evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/blob/e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb/backend/app/dispatch_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-o-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi" +parent = "065ef1ebaea854b3f2575db9a93f08313729aa09" +commit = "065ef1ebaea854b3f2575db9a93f08313729aa09" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 79 +fix_line = 16 +function = "seller_blurb_tile_332" +language = "python" +relpath = "backend/app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-332" +trap_id = "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/blob/065ef1ebaea854b3f2575db9a93f08313729aa09/backend/app/seller_operations.py#L79" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-oper" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi" +parent = "065ef1ebaea854b3f2575db9a93f08313729aa09" +commit = "065ef1ebaea854b3f2575db9a93f08313729aa09" +path = "backend/app/seller_operations.py" +fix_path = "backend/app/seller_operations.py" +mode = "enclosing" +line = 23 +fix_line = 16 +function = "seller_blurb_card_112" +language = "python" +relpath = "backend/app/seller_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-112" +trap_id = "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/blob/065ef1ebaea854b3f2575db9a93f08313729aa09/backend/app/seller_operations.py#L23" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-property-management-fastapi-tenant-op-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi" +parent = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +commit = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 42 +fix_line = 16 +function = "tenant_bundle_thaw_183" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-502" +class = "insecure_deserialization" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-183" +trap_id = "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-502", "CWE-20"] +evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi/blob/0048d045bc53534d7da5ef1bdf1c25072cfb3374/backend/app/tenant_operations.py#L42" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-property-management-fastapi-tenant-opera" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi" +parent = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +commit = "0048d045bc53534d7da5ef1bdf1c25072cfb3374" +path = "backend/app/tenant_operations.py" +fix_path = "backend/app/tenant_operations.py" +mode = "enclosing" +line = 38 +fix_line = 16 +function = "tenant_afterlane_117" +language = "python" +relpath = "backend/app/tenant_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-property-management-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-1-117" +trap_id = "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi/blob/0048d045bc53534d7da5ef1bdf1c25072cfb3374/backend/app/tenant_operations.py#L38" +vendored = false +review_tier = "seeded" +split = "train" + +[[recipe]] +name = "kimi-code-seeded-v2-support-desk-fastapi-support-operatio-2" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi" +parent = "76776570d1ff3607277ca2b1af2546b362d6e65b" +commit = "76776570d1ff3607277ca2b1af2546b362d6e65b" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 68 +fix_line = 16 +function = "ticket_blurb_tile_329" +language = "python" +relpath = "backend/app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-79" +class = "reflected_xss" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-329" +trap_id = "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-79", "CWE-80"] +evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi/blob/76776570d1ff3607277ca2b1af2546b362d6e65b/backend/app/support_operations.py#L68" +vendored = false +review_tier = "seeded" +split = "holdout" + +[[recipe]] +name = "kimi-code-seeded-v2-support-desk-fastapi-support-operations-" +host = "github" +repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi" +parent = "76776570d1ff3607277ca2b1af2546b362d6e65b" +commit = "76776570d1ff3607277ca2b1af2546b362d6e65b" +path = "backend/app/support_operations.py" +fix_path = "backend/app/support_operations.py" +mode = "enclosing" +line = 43 +fix_line = 16 +function = "ticket_return_lane_165" +language = "python" +relpath = "backend/app/support_operations.py" +license = "unlicensed" +cve = "" +year = 2026 +cwe = "CWE-601" +class = "open_redirect" +mechanism = "source_reaches_sink" +provenance = "agent" +origin = "real-vuln-benchmark" +project = "vc-kimi-code-seeded-v2-support-desk-fastapi" +framework = "fastapi" +gt_id = "seeded-v2-campaign-2-165" +trap_id = "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001" +acceptable_cwes = ["CWE-601", "CWE-20"] +evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement." +commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi/blob/76776570d1ff3607277ca2b1af2546b362d6e65b/backend/app/support_operations.py#L43" +vendored = false +review_tier = "seeded" +split = "train" + [[recipe]] name = "python-insecure-app-main-try-hack-me" host = "github" diff --git a/docs/examples.md b/docs/examples.md index 74acfc7..5bb53c7 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -36,6 +36,7 @@ uv run ousast benchmark benchmarks/manifests/python-vulnerable.toml --mode quick uv run ousast pairs # local fixtures + vendored GitHub VFCs uv run ousast pairs --slice github --json # honesty dashboard as JSON uv run ousast pairs --slice sast # OWASP Benchmark + Juliet Youden (TPR-FPR) +uv run ousast pairs --slice vibe-py --pointers # nightly: pointer pairs via the local cache (network) uv run python -m openultrasast.pair_gate # CI: local pairs must all pass ``` diff --git a/tests/test_pair_corpus.py b/tests/test_pair_corpus.py index b8e5517..9752594 100644 --- a/tests/test_pair_corpus.py +++ b/tests/test_pair_corpus.py @@ -464,9 +464,10 @@ def test_new_slices_load_offline_and_score_with_profiles() -> None: assert all(case.license for case in select_vendored(cases)), slice_name # pointer rows may be unlicensed (Req 10) assert all(case.provenance == expected_provenance for case in select_vendored(cases)), slice_name assert {case.split for case in cases} <= {"train", "holdout"} - header = cases[0].vuln_file.read_text()[:600] + vendored = select_vendored(cases) # pointer rows have no excerpt in the repository (Req 10) + header = vendored[0].vuln_file.read_text()[:600] assert "Provenance:" in header and "license:" in header - result = evaluate_catalog(cases[:2]) + result = evaluate_catalog(vendored[:2]) assert result.per_slice[slice_name].pairs == 2 assert set(result.per_profile) <= PROVENANCES and expected_provenance in result.per_profile assert result.per_mechanism and slice_name in result.loss @@ -963,3 +964,24 @@ def test_warm_cache_never_scores_pointer_pairs_when_network_is_off(tmp_path: Pat assert result.outcomes == () assert {"stage": "pairs", "reason": "pointer_pair_skipped", "pair": "ptr"} in result.degradations assert evaluate_catalog([case], pointers=True).outcomes[0].pair_correct # warm cache, network on: no fetch, scored + + +def test_vibe_py_and_agent_vfc_carry_pointer_rows_and_the_default_run_skips_them() -> None: + """Req 10.6: LLM-generated Real-Vuln repos are agent/seeded pointer rows; unlicensed agent fixes are title pointer rows.""" + import io + from contextlib import redirect_stdout + + catalog = load_pair_catalog() + vibe = select_slice(catalog, "vibe-py") + pointers = [case for case in vibe if not case.vendored] + assert len(pointers) >= 40 and len({case.repo for case in pointers}) >= 40 + assert all(case.provenance == "agent" and case.review_tier == "seeded" and not case.vuln_file.exists() for case in pointers) + assert len(select_vendored(vibe)) == 35 and all(case.provenance == "human" for case in select_vendored(vibe)) + agent_pointers = [case for case in select_slice(catalog, "agent-vfc") if not case.vendored] + assert len(agent_pointers) >= 20 and all(case.review_tier == "title" and case.license == "unlicensed" for case in agent_pointers) + buf = io.StringIO() + with redirect_stdout(buf): + assert main(["pairs", "--slice", "vibe-py", "--json"]) == 0 + payload = json.loads(buf.getvalue()) + skipped = [item for item in payload["degradations"] if item["reason"] == "pointer_pair_skipped"] + assert len(skipped) == len(pointers) and payload["overall"]["pairs"] == 35 diff --git a/tests/test_pair_harvest.py b/tests/test_pair_harvest.py index 978fe40..0f9fec8 100644 --- a/tests/test_pair_harvest.py +++ b/tests/test_pair_harvest.py @@ -424,3 +424,101 @@ def test_catalog_gen_emits_pointer_rows_without_excerpts(tmp_path: Path, monkeyp (case,) = _load_catalog_file(catalog) assert case.vendored is False and case.provenance == "agent" assert not (slice_root / "training" / "manifest.jsonl").read_text().strip() # pointer rows have no vendored files to train on + + +# --- task 8.4: pointer recipes from the builders (Req 10.6) --------------------- + + +def _ground_truth(tmp_path: Path) -> Path: + import json + + gt = tmp_path / "gt" + gt.mkdir() + repos = { + "realvuln-vc-llm-app": { + "repo_url": "https://github.com/k/vc-llm-app", + "commit_sha": "c1", + "authorship": "llm_generated", + "framework": "flask", + }, + "realvuln-human-nolic": { + "repo_url": "https://github.com/h/nolic", + "commit_sha": "c2", + "authorship": "human_authored", + "framework": "flask", + }, + "realvuln-human-mit": { + "repo_url": "https://github.com/h/mit", + "commit_sha": "c3", + "authorship": "human_authored", + "framework": "flask", + }, + } + (gt / "manifest.json").write_text(json.dumps({"repos": repos})) + findings = [ + { + "id": "v1", + "is_vulnerable": True, + "file": "app.py", + "location": {"function": "run", "start_line": 3}, + "vulnerability_class": "command_injection", + "primary_cwe": "CWE-78", + "evidence": {"description": "x"}, + }, + { + "id": "t1", + "is_vulnerable": False, + "file": "app.py", + "location": {"function": "safe", "start_line": 9}, + "vulnerability_class": "command_injection", + "primary_cwe": "CWE-78", + }, + ] + for repo_id in repos: + (gt / f"{repo_id}.json").write_text(json.dumps({"findings": findings})) + (gt / "licenses.json").write_text( + json.dumps( + { + "realvuln-vc-llm-app": {"full": "k/vc-llm-app", "license": ""}, + "realvuln-human-nolic": {"full": "h/nolic", "license": ""}, + "realvuln-human-mit": {"full": "h/mit", "license": "MIT"}, + } + ) + ) + return gt + + +def test_vibe_py_builder_pointers_mode_emits_llm_repos_as_unvendored_agent_rows(tmp_path: Path) -> None: + b = runpy.run_path(str(Path("benchmarks/pairs/vibe-py/build_recipes.py")), run_name="vibe_builder") + gt = _ground_truth(tmp_path) + recipes, skipped = b["build"]( + gt, gt / "licenses.json", per_repo=2, classes={"command_injection"}, allow_unlicensed=False, pointers=True + ) + by_repo = {r["repo"]: r for r in recipes} + assert set(by_repo) == {"k/vc-llm-app", "h/mit"} # unlicensed human repos are neither vendored nor pointed at + llm = by_repo["k/vc-llm-app"] + assert llm["vendored"] is False and llm["provenance"] == "agent" and llm["review_tier"] == "seeded" and llm["license"] == "unlicensed" + assert llm["function"] == "run" and llm["fix_path"] == "app.py" and llm["fix_line"] == 9 + assert "vendored" not in by_repo["h/mit"] and by_repo["h/mit"]["provenance"] == "human" + assert skipped["unlicensed"] == 1 + text = b["to_toml"](recipes) + import tomllib + + rows = tomllib.loads(text)["recipe"] + assert any(row.get("vendored") is False for row in rows) + + +def test_merge_recipes_keeps_existing_rows_and_appends_new_by_name() -> None: + lib = _lib() + existing = [{"name": "a", "repo": "x", "license": "MIT"}, {"name": "b", "repo": "y", "license": "MIT"}] + new = [{"name": "b", "repo": "changed"}, {"name": "c", "repo": "z", "vendored": False}] + merged, added = lib["merge_recipes"](existing, new) + assert [r["name"] for r in merged] == ["a", "b", "c"] and merged[1]["repo"] == "y" and added == ["c"] + + +def test_agent_vfc_builder_writes_toml_booleans() -> None: + import tomllib + + b = runpy.run_path(str(Path("benchmarks/pairs/agent-vfc/build_recipes.py")), run_name="agent_builder") + (row,) = tomllib.loads(b["to_toml"]([{"name": "p", "vendored": False, "line": 3, "reviewer": "pending"}]))["recipe"] + assert row["vendored"] is False and row["line"] == 3