diff --git a/.kiro/specs/harnessx-removal/tasks.md b/.kiro/specs/harnessx-removal/tasks.md index 6b98eb8..b55a615 100644 --- a/.kiro/specs/harnessx-removal/tasks.md +++ b/.kiro/specs/harnessx-removal/tasks.md @@ -4,7 +4,7 @@ Order follows the design's commit sequence (Requirement 5): nothing is deleted b and passed its fixture test. Every task is a commit gated on the full suite's own exit code, `ruff check`, `ruff format --check` and `mypy`; the reconciler stays under 500 lines. -- [ ] 1. Baseline without the extra +- [x] 1. Baseline without the extra - Equality script (design ยง3) with its `find_spec("harnessx")` and freeze checks; re-sync `.venv` without the `harnessx` extra first. - Record `benchmarks/measurements/-harnessx-removal-baseline/`: full suite, `ousast pairs --json`, the diff --git a/benchmarks/harnessx_removal_equality.py b/benchmarks/harnessx_removal_equality.py new file mode 100644 index 0000000..835c082 --- /dev/null +++ b/benchmarks/harnessx_removal_equality.py @@ -0,0 +1,396 @@ +"""Equality proof for the HarnessX removal (spec harnessx-removal, design section 3, Requirement 3). + +``record`` exports a frozen source tree, runs the deterministic commands with no model reachable and the +``harnessx`` extra absent, and stores their normalized outputs. ``compare`` diffs two such records and exits +non-zero on the first difference outside the exclusion list, naming the file and key. + +Usage: + python benchmarks/harnessx_removal_equality.py record [--tree-ish HEAD] [--workdir DIR] + python benchmarks/harnessx_removal_equality.py compare \\ + [--suite-map map.json] [--record comparison.json] + +The instrument checks come first and fail loudly: ``harnessx`` must not be importable, ``tree_sitter`` must be, +every child must import ``openultrasast`` from the export, every input manifest must be non-empty, every +command must exit 0, and every command must produce non-zero counts (pairs, TPs, expected findings, suite tests). +""" + +from __future__ import annotations + +import argparse +import hashlib +import importlib.util +import json +import os +import re +import shutil +import subprocess +import sys +import tempfile +import xml.etree.ElementTree as ET +from pathlib import Path +from typing import Any + +REPO = Path(__file__).resolve().parents[1] + +# Design section 3 "Comparison": timestamps, durations and run identifiers are excluded; nothing else is. +EXCLUDED_KEYS = frozenset({"runtime_seconds", "scan_id", "timestamp", "started", "finished", "created_at", "generated_at"}) +EXCLUDED_SUFFIXES = ("_seconds", "_ms") +RUN_ID = re.compile(r"\d{8}T\d{6}Z-[0-9a-f]{8}") +EXCLUSIONS = [ + f"JSON keys: {', '.join(sorted(EXCLUDED_KEYS))}", + f"JSON keys ending in: {', '.join(EXCLUDED_SUFFIXES)}", + "run directory names / run ids (-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> ", + "trace/events.jsonl as a whole (timings); never copied", + "the export's absolute root path -> ; the children's TMPDIR -> ", + "suite: only the outcome per test id is kept (junit durations dropped)", + "env.json is a provenance record (commit, freeze hash, instrument checks), not compared", +] + +INPUTS = ( + "benchmarks/pairs/catalog.toml", + "benchmarks/manifests/python-vulnerable.toml", + "benchmarks/manifests/java-spring-boot-vulnerable.toml", +) +SCAN_KEEP = ("findings.json", "verification.json", "fusion.json", "report.sarif", "harness.json", "manifest.json") +BENCH_KEEP = ("benchmark_result.json", "calibration_records.json", "external_baseline_deltas.json") + + +class InstrumentError(SystemExit): + def __init__(self, message: str) -> None: + super().__init__(f"instrument check failed: {message}") + + +def normalize(value: Any, root: str, tmp: str) -> Any: + """Drop excluded keys recursively and scrub the export root, TMPDIR and run ids from strings.""" + if isinstance(value, dict): + return {k: normalize(v, root, tmp) for k, v in value.items() if not _excluded(k)} + if isinstance(value, list): + return [normalize(v, root, tmp) for v in value] + if isinstance(value, str): + return scrub(value, root, tmp) + return value + + +def _excluded(key: str) -> bool: + return key in EXCLUDED_KEYS or key.endswith(EXCLUDED_SUFFIXES) + + +def scrub(text: str, root: str, tmp: str) -> str: + text = text.replace(tmp, "").replace(root, "") + return RUN_ID.sub("", text) + + +def dump(value: Any) -> str: + return json.dumps(value, indent=1, sort_keys=True) + "\n" + + +def _child_env(root: Path, tmp: Path) -> dict[str, str]: + env = {k: v for k, v in os.environ.items() if not k.endswith("_API_KEY") and k not in {"PYTHONPATH", "VIRTUAL_ENV"}} + env.update(OPENULTRASAST_SKIP_DOTENV="1", PYTHONPATH=str(root / "src"), TMPDIR=str(tmp), PYTHONHASHSEED="0") + return env + + +def _run(cmd: list[str], root: Path, env: dict[str, str], label: str) -> str: + proc = subprocess.run(cmd, cwd=root, env=env, capture_output=True, text=True, check=False) + if proc.returncode != 0: + tail = (proc.stdout + proc.stderr)[-2000:] + raise InstrumentError(f"{label} exited {proc.returncode}: {' '.join(cmd)}\n{tail}") + return proc.stdout + + +def _field(stdout: str, name: str) -> str: + for line in stdout.splitlines(): + if line.startswith(f"{name}="): + return line.partition("=")[2] + raise InstrumentError(f"no {name}= line in output") + + +def _freeze_hash() -> str: + uv = shutil.which("uv") + if uv is None: + raise InstrumentError("uv not found; cannot hash the environment") + out = subprocess.run([uv, "pip", "freeze", "--python", sys.executable], capture_output=True, text=True, check=True).stdout + return hashlib.sha256(out.encode()).hexdigest() + + +def _suite(xml_path: Path) -> dict[str, str]: + outcomes: dict[str, str] = {} + for case in ET.parse(xml_path).getroot().iter("testcase"): + test_id = f"{case.get('classname')}::{case.get('name')}" + kinds = {child.tag for child in case} + outcome = next((k for k in ("error", "failure", "skipped") if k in kinds), "passed") + outcomes[test_id] = outcome + return dict(sorted(outcomes.items())) + + +def record(out: Path, tree_ish: str, workdir: Path) -> None: + if importlib.util.find_spec("harnessx") is not None: + raise InstrumentError("harnessx is importable; re-sync the venv without the extra") + if importlib.util.find_spec("tree_sitter") is None: + raise InstrumentError("tree_sitter is not importable; the semantic extra is missing") + workdir.mkdir(parents=True, exist_ok=True) + root = Path(tempfile.mkdtemp(prefix="export-", dir=workdir)).resolve() + tmp = Path(tempfile.mkdtemp(prefix="tmp-", dir=workdir)).resolve() + archive = subprocess.run(["git", "-C", str(REPO), "archive", tree_ish], capture_output=True, check=True).stdout + subprocess.run(["tar", "-x", "-C", str(root)], input=archive, check=True) + env = _child_env(root, tmp) + rs, ts = str(root), str(tmp) + py = sys.executable + out.mkdir(parents=True, exist_ok=True) + checks: dict[str, Any] = {} + + module = _run([py, "-c", "import openultrasast; print(openultrasast.__file__)"], root, env, "import probe").strip() + if not module.startswith(rs): + raise InstrumentError(f"openultrasast imported from {module}, not the export {rs}") + checks["openultrasast_module"] = scrub(module, rs, ts) + inputs = {name: (root / name).stat().st_size for name in INPUTS} + if not all(inputs.values()): + raise InstrumentError(f"empty input manifest: {inputs}") + print(f"export={root} module={module} inputs={inputs}", flush=True) + + # 1. Full suite, outcome per test id. + junit = tmp / "suite.xml" + _run([py, "-m", "pytest", "-q", "-p", "no:cacheprovider", f"--junitxml={junit}"], root, env, "pytest") + suite = _suite(junit) + counts = {k: sum(1 for v in suite.values() if v == k) for k in ("passed", "skipped", "failure", "error")} + if counts["passed"] == 0: + raise InstrumentError("suite recorded no passing tests") + (out / "suite.json").write_text(dump(suite)) + checks["suite"] = counts + print(f"suite={counts}", flush=True) + + # 2. Pair replay (offline, vendored pairs only). + pairs = normalize(json.loads(_run([py, "-m", "openultrasast.cli", "pairs", "--json"], root, env, "pairs")), rs, ts) + checks["pairs"] = _pair_counts(pairs) + (out / "pairs.json").write_text(dump(pairs)) + print(f"pairs={checks['pairs']}", flush=True) + + # 3. Quick benchmark replay. + empty = tmp / "empty.toml" + empty.write_text("") + cmd = [ + py, + "-m", + "openultrasast.cli", + "benchmark", + "benchmarks/manifests/python-vulnerable.toml", + "--mode", + "quick", + "--config", + str(empty), + ] + stdout = _run(cmd, root, env, "benchmark") + expected = int(_field(stdout, "benchmark_expected")) + if expected <= 0: + raise InstrumentError("benchmark expected no findings") + checks["benchmark"] = {k: int(_field(stdout, f"benchmark_{k}")) for k in ("expected", "matched", "missed")} + checks["benchmark"]["findings"] = int(_field(stdout, "findings")) + _keep(Path(_field(stdout, "benchmark_run_dir")), BENCH_KEEP, out / "benchmark", rs, ts, checks, "benchmark_files") + (out / "benchmark" / "stdout.txt").write_text(scrub(stdout, rs, ts)) + print(f"benchmark={checks['benchmark']}", flush=True) + + # 4. One standard-mode scan (verify + fusion, no model configured). + cmd = [py, "-m", "openultrasast.cli", "scan", "benchmarks/fixtures/python-vulnerable", "--mode", "standard", "--config", str(empty)] + stdout = _run(cmd, root, env, "scan") + checks["scan"] = {"findings": int(_field(stdout, "findings")), "file_targets": int(_field(stdout, "file_targets"))} + if checks["scan"]["file_targets"] <= 0: + raise InstrumentError("standard scan saw no file targets") + _keep(Path(_field(stdout, "run_dir")), SCAN_KEEP, out / "scan", rs, ts, checks, "scan_files") + (out / "scan" / "stdout.txt").write_text(scrub(stdout, rs, ts)) + print(f"scan={checks['scan']}", flush=True) + + # 5. improve --dry-run; the shim keeps the dry-run journal the CLI writes to a throwaway directory. + shim_out = tmp / "improve" + cmd = [py, str(Path(__file__).resolve()), "_improve", str(shim_out), "benchmarks/manifests/java-spring-boot-vulnerable.toml"] + stdout = _run(cmd, root, env, "improve") + (out / "improve").mkdir(exist_ok=True) + (out / "improve" / "stdout.txt").write_text(scrub(stdout, rs, ts)) + # A round with no proposals writes no journal (evolve.py returns before append_round); its absence is + # recorded and compared like any file, so a journal appearing after the removal is a difference. + rounds = [line for line in stdout.splitlines() if line.startswith("round ")] + if not rounds or "rounds=" not in stdout: + raise InstrumentError("improve --dry-run printed no round") + journal = shim_out / "improve_journal.json" + checks["improve"] = {"rounds": len(rounds), "journal_bytes": journal.stat().st_size if journal.is_file() else None} + if journal.is_file(): + journal_data = normalize(json.loads(journal.read_text()), rs, ts) + (out / "improve" / "improve_journal.json").write_text(dump(journal_data)) + print(f"improve={checks['improve']}", flush=True) + + head = subprocess.run(["git", "-C", str(REPO), "rev-parse", tree_ish], capture_output=True, text=True, check=True).stdout.strip() + env_record = { + "tree_ish": head, + "freeze_sha256": _freeze_hash(), + "harnessx_importable": False, + "tree_sitter": True, + "python": sys.version.split()[0], + "child_env": {"OPENULTRASAST_SKIP_DOTENV": "1", "PYTHONHASHSEED": "0", "api_keys": "every *_API_KEY unset", "config": "empty"}, + "inputs": inputs, + "instrument_checks": checks, + "exclusions": EXCLUSIONS, + } + (out / "env.json").write_text(dump(env_record)) + (out / "README").write_text("Excluded from comparison: " + "; ".join(EXCLUSIONS) + "\n") + shutil.rmtree(root, ignore_errors=True) + shutil.rmtree(tmp, ignore_errors=True) + print(f"recorded {out}") + + +def _pair_counts(pairs: Any) -> dict[str, int]: + overall = pairs.get("overall", {}) if isinstance(pairs, dict) else {} + counts = {k: int(overall.get(k, 0)) for k in ("pairs", "detected_vuln", "pair_correct", "labeled_expected", "labeled_matched")} + counts["outcomes"] = len(pairs.get("outcomes", [])) if isinstance(pairs, dict) else 0 + if counts["pairs"] <= 0 or counts["detected_vuln"] <= 0 or counts["outcomes"] <= 0: + raise InstrumentError(f"pair replay saw {counts}") + return counts + + +def _keep(run_dir: Path, names: tuple[str, ...], dest: Path, rs: str, ts: str, checks: dict[str, Any], key: str) -> None: + if not run_dir.is_dir(): + raise InstrumentError(f"run directory missing: {run_dir}") + dest.mkdir(parents=True, exist_ok=True) + present = {} + for name in names: + source = run_dir / name + if source.is_file(): + present[name] = source.stat().st_size + (dest / name).write_text(dump(normalize(json.loads(source.read_text()), rs, ts))) + checks[key] = present + + +def _improve_shim(out: Path, manifest: str) -> int: + """Run ``ousast improve --dry-run --no-pair-gate`` and copy the throwaway journal out before cleanup.""" + from openultrasast import cli + + original = tempfile.TemporaryDirectory + + class Keeping(original): # type: ignore[misc,valid-type] + def cleanup(self) -> None: + out.mkdir(parents=True, exist_ok=True) + for name in ("improve_journal.json",): + if (Path(self.name) / name).is_file(): + shutil.copy2(Path(self.name) / name, out / name) + super().cleanup() + + def __exit__(self, *exc: object) -> None: + self.cleanup() + + cli.tempfile.TemporaryDirectory = Keeping # type: ignore[misc] + try: + return int(cli.main(["improve", manifest, "--dry-run", "--no-pair-gate"]) or 0) + finally: + cli.tempfile.TemporaryDirectory = original # type: ignore[misc] + + +def compare(baseline: Path, candidate: Path, suite_map: dict[str, Any]) -> list[str]: + """Return every difference outside the exclusion list; empty means equal.""" + diffs: list[str] = [] + diffs += _compare_suite( + json.loads((baseline / "suite.json").read_text()), json.loads((candidate / "suite.json").read_text()), suite_map + ) + files = sorted( + {p.relative_to(baseline).as_posix() for p in baseline.rglob("*") if p.is_file()} + | {p.relative_to(candidate).as_posix() for p in candidate.rglob("*") if p.is_file()} + ) + for name in files: + if name in {"suite.json", "env.json", "README", "comparison.json", "determinism.json"}: + continue + a, b = baseline / name, candidate / name + if not a.is_file() or not b.is_file(): + diffs.append(f"{name}: present only in {'candidate' if b.is_file() else 'baseline'}") + continue + if a.read_bytes() == b.read_bytes(): + continue + if name.endswith((".json", ".sarif")): + diffs.append(f"{name}: {_first_json_diff(json.loads(a.read_text()), json.loads(b.read_text()), '$')}") + else: + diffs.append(f"{name}: first differing line {_first_line_diff(a.read_text(), b.read_text())}") + return diffs + + +def _compare_suite(a: dict[str, str], b: dict[str, str], suite_map: dict[str, Any]) -> list[str]: + deleted = set(suite_map.get("deleted", ())) + renamed: dict[str, str] = dict(suite_map.get("renamed", {})) + added = set(suite_map.get("added", ())) | set(renamed.values()) + diffs = [] + for test_id, outcome in a.items(): + if test_id in deleted: + continue + target = renamed.get(test_id, test_id) + if target not in b: + diffs.append(f"suite.json: {test_id} missing from candidate") + elif b[target] != outcome: + diffs.append(f"suite.json: {test_id} {outcome} -> {b[target]}") + diffs += [f"suite.json: {t} new in candidate" for t in b if t not in a and t not in added] + return diffs + + +def _first_json_diff(a: Any, b: Any, path: str) -> str: + if type(a) is not type(b): + return f"{path}: type {type(a).__name__} -> {type(b).__name__}" + if isinstance(a, dict): + for key in sorted(set(a) | set(b)): + if key not in a or key not in b: + return f"{path}.{key}: present only in {'candidate' if key in b else 'baseline'}" + if a[key] != b[key]: + return _first_json_diff(a[key], b[key], f"{path}.{key}") + if isinstance(a, list): + if len(a) != len(b): + return f"{path}: length {len(a)} -> {len(b)}" + for i, (x, y) in enumerate(zip(a, b, strict=True)): + if x != y: + return _first_json_diff(x, y, f"{path}[{i}]") + return f"{path}: {json.dumps(a)[:120]} -> {json.dumps(b)[:120]}" + + +def _first_line_diff(a: str, b: str) -> str: + la, lb = a.splitlines(), b.splitlines() + for i, (x, y) in enumerate(zip(la, lb, strict=False), 1): + if x != y: + return f"{i}: {x[:120]!r} -> {y[:120]!r}" + return f"line count {len(la)} -> {len(lb)}" + + +def main(argv: list[str] | None = None) -> int: + parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + sub = parser.add_subparsers(dest="command", required=True) + rec = sub.add_parser("record") + rec.add_argument("out", type=Path) + rec.add_argument("--tree-ish", default="HEAD", help="git tree-ish to export (a commit, or `git write-tree` for the index)") + rec.add_argument("--workdir", type=Path, default=Path(tempfile.gettempdir()) / "hxr-equality") + cmp_ = sub.add_parser("compare") + cmp_.add_argument("baseline", type=Path) + cmp_.add_argument("candidate", type=Path) + cmp_.add_argument("--suite-map", type=Path, help='JSON {"deleted": [...], "renamed": {old: new}, "added": [...]}') + cmp_.add_argument("--record", type=Path, help="write the comparison result here as JSON") + shim = sub.add_parser("_improve") + shim.add_argument("out", type=Path) + shim.add_argument("manifest") + args = parser.parse_args(argv) + if args.command == "record": + record(args.out.resolve(), args.tree_ish, args.workdir.resolve()) + return 0 + if args.command == "_improve": + return _improve_shim(args.out, args.manifest) + suite_map = json.loads(args.suite_map.read_text()) if args.suite_map else {} + diffs = compare(args.baseline, args.candidate, suite_map) + if args.record: + args.record.write_text( + dump( + { + "baseline": str(args.baseline), + "candidate": str(args.candidate), + "equal": not diffs, + "differences": diffs, + "exclusions": EXCLUSIONS, + } + ) + ) + for line in diffs[:20]: + print(line) + print(f"equal={not diffs} differences={len(diffs)}") + return 1 if diffs else 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/README b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/README new file mode 100644 index 0000000..467251c --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/README @@ -0,0 +1 @@ +Excluded from comparison: JSON keys: created_at, finished, generated_at, runtime_seconds, scan_id, started, timestamp; JSON keys ending in: _seconds, _ms; run directory names / run ids (-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> ; trace/events.jsonl as a whole (timings); never copied; the export's absolute root path -> ; the children's TMPDIR -> ; suite: only the outcome per test id is kept (junit durations dropped); env.json is a provenance record (commit, freeze hash, instrument checks), not compared diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/benchmark_result.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/benchmark_result.json new file mode 100644 index 0000000..0b3955e --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/benchmark_result.json @@ -0,0 +1,181 @@ +{ + "baseline_deltas": [], + "benchmark_name": "python-vulnerable", + "benchmark_run_id": "", + "calibration_records": [ + { + "cwe": "CWE-89", + "evidence": "execute runs a SQL query string built from request input on a prior line", + "failed_stage": "benchmark_ground_truth_matching", + "next_improvement_candidate": "language_hunter", + "path": "app.py", + "reason": "no OpenUltraSAST finding matched the expected benchmark vulnerability", + "rule_id": null, + "vulnerability_class": "sql injection" + } + ], + "false_positives": [], + "language": "python_web", + "metrics": { + "actual_findings_total": 12, + "artifact_links": { + "findings": "/benchmarks/fixtures/python-vulnerable/.openultrasast/runs//findings.json", + "manifest": "/benchmarks/fixtures/python-vulnerable/.openultrasast/runs//manifest.json", + "report": "/benchmarks/fixtures/python-vulnerable/.openultrasast/runs//report.md", + "sarif": "/benchmarks/fixtures/python-vulnerable/.openultrasast/runs//report.sarif" + }, + "expected_findings_total": 13, + "false_positive_findings_total": 0, + "matched_findings_total": 12, + "missed_findings_total": 1, + "model_usage": {}, + "per_rule": { + "python-flask-debug": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-os-command": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-path-traversal": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-shell-true": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-sql-injection": { + "false_positives": 0, + "matched": 2, + "missed": 0 + }, + "python-ssrf": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-ssti": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-unsafe-deserialization": { + "false_positives": 0, + "matched": 2, + "missed": 0 + }, + "python-unsafe-eval": { + "false_positives": 0, + "matched": 1, + "missed": 0 + }, + "python-weak-hash": { + "false_positives": 0, + "matched": 1, + "missed": 0 + } + }, + "precision": 1.0, + "recall": 0.9230769230769231 + }, + "misses": [ + { + "cwe": "CWE-89", + "evidence": "execute runs a SQL query string built from request input on a prior line", + "path": "app.py", + "reason": "no OpenUltraSAST finding matched the expected benchmark vulnerability", + "rule_id": null, + "vulnerability_class": "sql injection" + } + ], + "mode": "quick", + "rule_recommendations": [ + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-flask-debug" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-os-command" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-path-traversal" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-shell-true" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 2, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-sql-injection" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-ssrf" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-ssti" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 2, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-unsafe-deserialization" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-unsafe-eval" + }, + { + "action": "keep", + "false_positives": 0, + "matched": 1, + "missed": 0, + "rationale": "rule matched expected findings with no false positives", + "rule_id": "python-weak-hash" + } + ], + "scan_run_dir": "/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/" +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/calibration_records.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/calibration_records.json new file mode 100644 index 0000000..7223359 --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/calibration_records.json @@ -0,0 +1,12 @@ +[ + { + "cwe": "CWE-89", + "evidence": "execute runs a SQL query string built from request input on a prior line", + "failed_stage": "benchmark_ground_truth_matching", + "next_improvement_candidate": "language_hunter", + "path": "app.py", + "reason": "no OpenUltraSAST finding matched the expected benchmark vulnerability", + "rule_id": null, + "vulnerability_class": "sql injection" + } +] diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/external_baseline_deltas.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/external_baseline_deltas.json new file mode 100644 index 0000000..fe51488 --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/external_baseline_deltas.json @@ -0,0 +1 @@ +[] diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/stdout.txt b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/stdout.txt new file mode 100644 index 0000000..acb394c --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/benchmark/stdout.txt @@ -0,0 +1,11 @@ +scan_id= +run_dir=/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/ +file_targets=2 +ranked_targets=2 +findings=12 +calibrations_applied=0 +benchmark_run_id= +benchmark_run_dir=/benchmarks/fixtures/python-vulnerable/.openultrasast/benchmarks/ +benchmark_expected=13 +benchmark_matched=12 +benchmark_missed=1 diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/determinism.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/determinism.json new file mode 100644 index 0000000..fbd719a --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/determinism.json @@ -0,0 +1,16 @@ +{ + "baseline": "this directory (record run A)", + "candidate": "record run B: second independent record from a fresh export of the same tree, same venv; not committed", + "differences": [], + "equal": true, + "exclusions": [ + "JSON keys: created_at, finished, generated_at, runtime_seconds, scan_id, started, timestamp", + "JSON keys ending in: _seconds, _ms", + "run directory names / run ids (-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> ", + "trace/events.jsonl as a whole (timings); never copied", + "the export's absolute root path -> ; the children's TMPDIR -> ", + "suite: only the outcome per test id is kept (junit durations dropped)", + "env.json is a provenance record (commit, freeze hash, instrument checks), not compared" + ], + "raw_bytes_identical": "all 15 files incl. env.json (diff -r empty)" +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/env.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/env.json new file mode 100644 index 0000000..447886f --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/env.json @@ -0,0 +1,71 @@ +{ + "child_env": { + "OPENULTRASAST_SKIP_DOTENV": "1", + "PYTHONHASHSEED": "0", + "api_keys": "every *_API_KEY unset", + "config": "empty" + }, + "exclusions": [ + "JSON keys: created_at, finished, generated_at, runtime_seconds, scan_id, started, timestamp", + "JSON keys ending in: _seconds, _ms", + "run directory names / run ids (-<8 hex>, benchmark.py create_benchmark_run, run.py create_scan_run) -> ", + "trace/events.jsonl as a whole (timings); never copied", + "the export's absolute root path -> ; the children's TMPDIR -> ", + "suite: only the outcome per test id is kept (junit durations dropped)", + "env.json is a provenance record (commit, freeze hash, instrument checks), not compared" + ], + "freeze_sha256": "0e5ad41948a751e1c60f72738c48f5ac482b24b67e51c77369ab3be51fa418eb", + "harnessx_importable": false, + "inputs": { + "benchmarks/manifests/java-spring-boot-vulnerable.toml": 1032, + "benchmarks/manifests/python-vulnerable.toml": 2771, + "benchmarks/pairs/catalog.toml": 6052 + }, + "instrument_checks": { + "benchmark": { + "expected": 13, + "findings": 12, + "matched": 12, + "missed": 1 + }, + "benchmark_files": { + "benchmark_result.json": 5891, + "calibration_records.json": 406, + "external_baseline_deltas.json": 3 + }, + "improve": { + "journal_bytes": null, + "rounds": 1 + }, + "openultrasast_module": "/src/openultrasast/__init__.py", + "pairs": { + "detected_vuln": 57, + "labeled_expected": 342, + "labeled_matched": 82, + "outcomes": 317, + "pair_correct": 32, + "pairs": 317 + }, + "scan": { + "file_targets": 2, + "findings": 17 + }, + "scan_files": { + "findings.json": 20469, + "fusion.json": 6284, + "harness.json": 189, + "manifest.json": 13265, + "report.sarif": 40310, + "verification.json": 10573 + }, + "suite": { + "error": 0, + "failure": 0, + "passed": 1688, + "skipped": 36 + } + }, + "python": "3.11.13", + "tree_ish": "ca420bfb99d649f01030b8a28ff3ffa4b32d1b22", + "tree_sitter": true +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/improve/stdout.txt b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/improve/stdout.txt new file mode 100644 index 0000000..6e30aa1 --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/improve/stdout.txt @@ -0,0 +1,5 @@ +manifest=benchmarks/manifests/java-spring-boot-vulnerable.toml +target=/benchmarks/fixtures/java-spring-boot-vulnerable +round 1: no_proposals | recall 100.00%->100.00% fp 0.00%->0.00% score 73->73 | edits: - +rounds=1 accepted=0 +dry_run=true (no ledger or mechanism store written) diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/pairs.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/pairs.json new file mode 100644 index 0000000..55770af --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/pairs.json @@ -0,0 +1,17216 @@ +{ + "achievable": { + "agent-vfc": { + "detected_vuln": 1, + "labeled_expected": 28, + "labeled_fix_leaks": 4, + "labeled_matched": 1, + "labeled_recall": 0.03571428571428571, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 28, + "silent_fix": 25, + "specificity": 0.8928571428571429, + "vuln_recall": 0.03571428571428571, + "youden": -0.07142857142857138 + }, + "github": { + "detected_vuln": 4, + "labeled_expected": 6, + "labeled_fix_leaks": 0, + "labeled_matched": 4, + "labeled_recall": 0.6666666666666666, + "pair_correct": 4, + "pair_pass_rate": 0.6666666666666666, + "pairs": 6, + "silent_fix": 6, + "specificity": 1.0, + "vuln_recall": 0.6666666666666666, + "youden": 0.6666666666666666 + }, + "local": { + "detected_vuln": 3, + "labeled_expected": 28, + "labeled_fix_leaks": 0, + "labeled_matched": 28, + "labeled_recall": 1.0, + "pair_correct": 3, + "pair_pass_rate": 1.0, + "pairs": 3, + "silent_fix": 3, + "specificity": 1.0, + "vuln_recall": 1.0, + "youden": 1.0 + }, + "owasp": { + "detected_vuln": 9, + "labeled_expected": 40, + "labeled_fix_leaks": 12, + "labeled_matched": 9, + "labeled_recall": 0.225, + "pair_correct": 2, + "pair_pass_rate": 0.05, + "pairs": 40, + "silent_fix": 28, + "specificity": 0.7, + "vuln_recall": 0.225, + "youden": -0.07500000000000004 + }, + "sast": { + "detected_vuln": 6, + "labeled_expected": 10, + "labeled_fix_leaks": 3, + "labeled_matched": 6, + "labeled_recall": 0.6, + "pair_correct": 4, + "pair_pass_rate": 0.4, + "pairs": 10, + "silent_fix": 7, + "specificity": 0.7, + "vuln_recall": 0.6, + "youden": 0.29999999999999993 + }, + "vfc": { + "detected_vuln": 9, + "labeled_expected": 176, + "labeled_fix_leaks": 66, + "labeled_matched": 9, + "labeled_recall": 0.05113636363636364, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 176, + "silent_fix": 144, + "specificity": 0.8181818181818182, + "vuln_recall": 0.05113636363636364, + "youden": -0.13068181818181812 + }, + "vfc-js": { + "detected_vuln": 9, + "labeled_expected": 17, + "labeled_fix_leaks": 9, + "labeled_matched": 9, + "labeled_recall": 0.5294117647058824, + "pair_correct": 4, + "pair_pass_rate": 0.23529411764705882, + "pairs": 17, + "silent_fix": 10, + "specificity": 0.5882352941176471, + "vuln_recall": 0.5294117647058824, + "youden": 0.11764705882352944 + }, + "vibe-py": { + "detected_vuln": 15, + "labeled_expected": 30, + "labeled_fix_leaks": 0, + "labeled_matched": 15, + "labeled_recall": 0.5, + "pair_correct": 15, + "pair_pass_rate": 0.5, + "pairs": 30, + "silent_fix": 30, + "specificity": 1.0, + "vuln_recall": 0.5, + "youden": 0.5 + } + }, + "degradations": [ + { + "pair": "claude-code-seeded-v2-crm-saas-django-partner-console-acct-p", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-crm-saas-django-partner-console-acct-r", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-education-lms-django-course-operati-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-education-lms-django-course-operations", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-fintech-lending-fastapi-loan-operat-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-fintech-lending-fastapi-loan-operation", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-healthcare-clinic-django-patient-op-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-healthcare-clinic-django-patient-opera", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-hr-payroll-django-payroll-operation-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-hr-payroll-django-payroll-operations-p", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-legal-case-django-case-operations-c-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-legal-case-django-case-operations-case", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-op", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-op", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-property-management-fastapi-tenant--2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-property-management-fastapi-tenant-ope", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-support-desk-fastapi-support-operat-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "claude-code-seeded-v2-support-desk-fastapi-support-operation", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-crm-saas-django-partner-console-acct-fo", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-crm-saas-django-partner-console-acct-va", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-education-lms-django-course-operatio-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-education-lms-django-course-operations-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-fintech-lending-fastapi-loan-operati-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-fintech-lending-fastapi-loan-operations", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-healthcare-clinic-django-patient-ope-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-healthcare-clinic-django-patient-operat", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-hr-payroll-django-payroll-operations-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-hr-payroll-django-payroll-operations-pa", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-legal-case-django-case-operations-ca-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-legal-case-django-case-operations-case-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch--2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch-ope", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-marketplace-commerce-fastapi-seller--2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-marketplace-commerce-fastapi-seller-ope", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-property-management-fastapi-tenant-o-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-property-management-fastapi-tenant-oper", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-support-desk-fastapi-support-operati-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-high-seeded-v2-support-desk-fastapi-support-operations", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-crm-saas-django-partner-console-account-wayb", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-crm-saas-django-partner-console-acct-bundle-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-education-lms-django-course-operations-co-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-education-lms-django-course-operations-cours", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-fintech-lending-fastapi-loan-operations-l-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-fintech-lending-fastapi-loan-operations-loan", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-healthcare-clinic-django-patient-operatio-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-healthcare-clinic-django-patient-operations-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-hr-payroll-django-payroll-operations-payr-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-hr-payroll-django-payroll-operations-payroll", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-legal-case-django-case-operations-case-bundl", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-legal-case-django-case-operations-case-retur", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-opera-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-operatio", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-marketplace-commerce-fastapi-seller-opera-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-marketplace-commerce-fastapi-seller-operatio", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-property-management-fastapi-tenant-operat-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-property-management-fastapi-tenant-operation", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-support-desk-fastapi-support-operations-t-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "codex-seeded-v2-support-desk-fastapi-support-operations-tick", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-crm-saas-django-partner-console-account-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-crm-saas-django-partner-console-acct-bun", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-education-lms-django-course-operation-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-education-lms-django-course-operations-c", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operatio-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operations-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-healthcare-clinic-django-patient-oper-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-healthcare-clinic-django-patient-operati", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-hr-payroll-django-payroll-operations--2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-hr-payroll-django-payroll-operations-pay", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-legal-case-django-case-operations-case-b", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-legal-case-django-case-operations-case-r", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-o-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-oper", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-o-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-oper", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-property-management-fastapi-tenant-op-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-property-management-fastapi-tenant-opera", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-support-desk-fastapi-support-operatio-2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "kimi-code-seeded-v2-support-desk-fastapi-support-operations-", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "ah-05-07-main-0f68d7", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "ai-file-manager-searcher-2c8f65", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "audienceos-command-center-route-7b2b31", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "backend-gym-main-37aec0", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "bricks-document-viewer-client-8daa7c", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "bushiri-index-bd1c99", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "career-copilot-matches-eaa75e", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "chatpro-index-99dcd3", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "comp-6000-capstone2-index-388195", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "easy-q-api-a31c36", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "ems-contract-analyzer-app-00884c", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "enterprise-ai-lakehouse-platform-main-11e36d", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "findconstructionstaffing-route-24edf4", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "fitnesstracker-communityfoods-115204", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "flytte24-views-8a5f7a", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "fusmle-index-47f075", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "green-mobile-offline-backend-example-482952", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "iterviz-orchestrator-c59620", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "jogo-da-velha-rotas-326bac", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "joidy-main-a2fa2c", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "learnly-page-a4c6b2", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "neutral-server-033e5f", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "niners-initializecollections-b90f9c", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "nuvanx-siteground-validate-page-templates-7ccb5b", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "shift-left-or-die-database-68a00a", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "signaldigest-route-8ca292", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "soulclaw-pw-session-1346a0", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "tabletap-safe-next-33ff1b", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "tracechantier-web-route-cbdafd", + "reason": "pointer_pair_skipped", + "stage": "pairs" + }, + { + "pair": "unimart-backend-auth-controller-3ee79a", + "reason": "pointer_pair_skipped", + "stage": "pairs" + } + ], + "known_limit": [ + "owasp-java-hash", + "dsvw-dsvw-do-get", + "python-insecure-app-main-try-hack-me", + "pythonssti-main-read-root", + "vampi-books-get-by-title", + "vulnpy-deserialization-do-pickle-load", + "lensops-kubernetesmanagement-fe4910" + ], + "loss": { + "agent-vfc": { + "known_limit": 1, + "parse_failed_files": 0, + "unadjudicated_proposals": 0, + "unresolved_function_labels": 0, + "weak_labels": 0 + }, + "github": { + "known_limit": 0, + "parse_failed_files": 0, + "unadjudicated_proposals": 0, + "unresolved_function_labels": 0, + "weak_labels": 0 + }, + "local": { + "known_limit": 0, + "parse_failed_files": 0, + "unadjudicated_proposals": 0, + "unresolved_function_labels": 0, + "weak_labels": 0 + }, + "owasp": { + "known_limit": 0, + "parse_failed_files": 0, + "unadjudicated_proposals": 0, + "unresolved_function_labels": 0, + "weak_labels": 0 + }, + "sast": { + "known_limit": 1, + "parse_failed_files": 0, + "unadjudicated_proposals": 6, + "unresolved_function_labels": 0, + "weak_labels": 0 + }, + "vfc": { + "known_limit": 0, + "parse_failed_files": 36, + "unadjudicated_proposals": 128, + "unresolved_function_labels": 24, + "weak_labels": 0 + }, + "vfc-js": { + "known_limit": 0, + "parse_failed_files": 0, + "unadjudicated_proposals": 9, + "unresolved_function_labels": 0, + "weak_labels": 0 + }, + "vibe-py": { + "known_limit": 5, + "parse_failed_files": 0, + "unadjudicated_proposals": 14, + "unresolved_function_labels": 0, + "weak_labels": 0 + } + }, + "outcomes": [ + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "local-python-vulnerable", + "origin": "in-tree-fixture", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "reviewed", + "silent_fix": true, + "slice": "local", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 12, + "vuln_findings": 12, + "vuln_matched": 12, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "local-javascript-vulnerable", + "origin": "in-tree-fixture", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "reviewed", + "silent_fix": true, + "slice": "local", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 10, + "vuln_findings": 10, + "vuln_matched": 10, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "local-cpp-buffer", + "origin": "in-tree-fixture", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "reviewed", + "silent_fix": true, + "slice": "local", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 6, + "vuln_findings": 6, + "vuln_matched": 6, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Internet-of-People/titania-os/commit/9b7805119938343fcac9dc929d8882f1d97cf14a", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "sven-cwe-078-os-system", + "origin": "sven", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "github", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/google/mobly/commit/3862e8ba359040fbdd6e1a6d36e51d07cda8e1ee", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "sven-cwe-078-shell-true", + "origin": "sven", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "github", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/russ-lewis/ttt_-_python_cgi/commit/6096f43fd4b2d91211eec4614b7960c0816900da", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "sven-cwe-089-execute-percent", + "origin": "sven", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "github", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/pukkapies/urop2019/commit/3ca2e2c291d2d5fe262d20a8e0520bdfb622432b", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:modules/query_lastfm.py:CWE-89" + ], + "name": "sven-cwe-089-query-concat", + "origin": "sven", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "github", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dromara/hutool/commit/8d7d0b7fb5ea4f7447b40131bffc1ec506a6528e", + "cve": "CVE-2018-17297", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:cn/hutool/core/util/ZipUtil.java:CWE-22" + ], + "name": "hutool-cve-2018-17297", + "origin": "cwe-bench-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "github", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5941", + "cve": "CVE-2017-5941", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "node-serialize-cve-2017-5941", + "origin": "nvd", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "github", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "python-unsafe-eval:testcode/BenchmarkTest00074.py:CWE-94" + ], + "name": "owasp-python-codeinj", + "origin": "owasp-benchmark-python", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "owasp-python-deser", + "origin": "owasp-benchmark-python", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "python", + "leaks": [ + "python-shell-true:testcode/BenchmarkTest00165.py:58" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "python-shell-true:testcode/BenchmarkTest00165.py:CWE-78" + ], + "name": "owasp-python-cmdi", + "origin": "owasp-benchmark-python", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "sast", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "python-sql-injection:testcode/BenchmarkTest00099.py:CWE-89" + ], + "name": "owasp-python-sqli", + "origin": "owasp-benchmark-python", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "config_sink_weak_literal" + ], + "misses": [ + "python-weak-hash:testcode/BenchmarkTest00054.py:CWE-327" + ], + "name": "owasp-python-hash", + "origin": "owasp-benchmark-python", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "owasp-java-cmdi", + "origin": "owasp-benchmark-java", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:org/owasp/benchmark/testcode/BenchmarkTest00008.java:54:executeQuery" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "owasp-java-sqli", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "sast", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": "cross_artifact: OWASP labels this true via hashAlg1=MD5 in benchmark.properties, which is not in the vendored file", + "language": "java", + "leaks": [ + "overlay-coverage:org/owasp/benchmark/testcode/BenchmarkTest00003.java:100:response.write" + ], + "mechanisms": [ + "cross_artifact" + ], + "misses": [ + "java-weak-hash:org/owasp/benchmark/testcode/BenchmarkTest00003.java:CWE-327" + ], + "name": "owasp-java-hash", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "sast", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "juliet-c-cwe134-printf", + "origin": "juliet-c", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-copy:CWE121_char_declare_cpy_01.c:16" + ], + "mechanisms": [ + "fixed_buffer_capacity" + ], + "misses": [], + "name": "juliet-c-cwe121-strcpy", + "origin": "juliet-c", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "sast", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "juliet-java-cwe78-exec", + "origin": "juliet-java", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "sast", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/96db9023b881d7cd9f379b0c154650d6c108e9a3", + "cve": "CVE-2014-0160", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/t1_lib.c:80" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2014-0160", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://hg.mozilla.org/mozilla-central/rev/b79b6cc78248eea7fda10bfb76aa273c19c9fa65", + "cve": "CVE-2020-15667", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:modules/libmar/src/mar_read.c:46" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "firefox-cve-2020-15667", + "origin": "mozilla-central", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/chromium/chromium/commit/ba9748e78ec7e9c0d594e7edf7b2c07ea2a90449", + "cve": "CVE-2019-5786", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "uaf" + ], + "misses": [ + "c-unsafe-memory-copy:third_party/blink/renderer/core/fileapi/file_reader_loader.cc:CWE-416" + ], + "name": "chromium-cve-2019-5786", + "origin": "chromium", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a87f3fe01a5a894aa27ccd6a239155fd129988e4", + "cve": "CVE-2020-1967", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:ssl/t1_lib.c:CWE-476" + ], + "name": "openssl-cve-2020-1967", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b33c48b75aaf33c93aeda42d7138616b9e6a64cb", + "cve": "CVE-2020-1971", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/x509/v3_genn.c:CWE-476" + ], + "name": "openssl-cve-2020-1971", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/c9fb704cf3af5524eb8e79961e31b60eee8c3c47", + "cve": "CVE-2021-23840", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:60", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:78", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:97" + ], + "mechanisms": [ + "signed_size_operand" + ], + "misses": [ + "-:crypto/evp/evp_enc.c:CWE-190" + ], + "name": "openssl-cve-2021-23840", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/59f5e75f3bced8fc0e130d72a3f582cf7b480b46", + "cve": "CVE-2021-3711", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/sm2/sm2_crypt.c:CWE-120" + ], + "name": "openssl-cve-2021-3711", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/98624776c4d501c8badd6f772ab7048ac9191cb9", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/x509/v3_utl.c:CWE-125" + ], + "name": "openssl-cve-2021-3712", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/9eafb53614bf65797db25f467946e735e1b43dc9", + "cve": "CVE-2022-0778", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/bn/bn_sqrt.c:CWE-835" + ], + "name": "openssl-cve-2022-0778", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2", + "cve": "CVE-2022-1292", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "unknown", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:tools/c_rehash.in:CWE-78" + ], + "name": "openssl-cve-2022-1292", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/3b421ebc64c7b52f1b9feb3812bdc7781c784332", + "cve": "CVE-2022-3602", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/punycode.c:81" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2022-3602", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/680e65b94c916af259bfdc2e25f1ab6e0c7a97d6", + "cve": "CVE-2022-3786", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/punycode.c:80" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2022-3786", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7880536fe17c2b5450e279155bedd51771d28c9f", + "cve": "CVE-2023-0286", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "type_confusion" + ], + "misses": [ + "-:crypto/x509/v3_genn.c:CWE-843" + ], + "name": "openssl-cve-2023-0286", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/fb4415d8aee6c1045be932a34fe6107c2f5ed147", + "cve": "CVE-2023-38545", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 5, + "fix_leaks": 5, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:lib/socks.c:197", + "c-unsafe-memory-copy:lib/socks.c:207", + "c-unsafe-memory-copy:lib/socks.c:360", + "c-unsafe-memory-copy:lib/socks.c:367", + "c-unsafe-memory-copy:lib/socks.c:373" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "c-unsafe-memory-copy:lib/socks.c:CWE-122" + ], + "name": "curl-cve-2023-38545", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 5, + "unadjudicated_vuln": 5, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 5, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/chromium/chromium/commit/22c61cfae5d1b37c773e638d342488ae11118b51", + "cve": "CVE-2022-2162", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "validation_strength" + ], + "misses": [ + "-:content/browser/file_system_access/file_system_chooser.cc:CWE-20" + ], + "name": "chromium-cve-2022-2162", + "origin": "chromium", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2c13bf15286328641a805eb3b7c97e27d42881fb", + "cve": "CVE-2025-69421", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/pkcs12/p12_decr.c:CWE-476" + ], + "name": "openssl-cve-2025-69421", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/84f73f79af9f69c1527a9a372b7a9e771a394c2a", + "cve": "CVE-2025-66199", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_alloc_size" + ], + "misses": [ + "-:ssl/statem/statem_lib.c:CWE-770" + ], + "name": "openssl-cve-2025-66199", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/mozilla-firefox/firefox/commit/e46f28da1cd3a5d46a2680b3d87361e9e8de4ae6", + "cve": "BUG-2058173", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_alloc_size" + ], + "misses": [ + "-:modules/libmar/src/mar_read.c:CWE-770" + ], + "name": "firefox-bug-2058173", + "origin": "mozilla-firefox/firefox", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af", + "cve": "CVE-2026-18798", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/quic/quic_port.c:CWE-119" + ], + "name": "openssl-cve-2026-18798", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/1ca5a124b48f1ffe6980ad33724b452fbd62da1e", + "cve": "CVE-2026-54874", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/record/rec_layer_d1.c:CWE-119" + ], + "name": "openssl-cve-2026-54874", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/1ca5a124b48f1ffe6980ad33724b452fbd62da1e", + "cve": "CVE-2026-54874", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/record/ssl3_record.c:CWE-119" + ], + "name": "openssl-cve-2026-54874-dtls1_process_record", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40", + "cve": "CVE-2026-54874", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/record/methods/dtls_meth.c:44" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/record/methods/dtls_meth.c:CWE-119" + ], + "name": "openssl-cve-2026-54874-dtls_rlayer_buffer_recor", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 2, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382", + "cve": "CVE-2026-63072", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/cms/cms_kari.c:CWE-119" + ], + "name": "openssl-cve-2026-63072", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756", + "cve": "CVE-2026-63072", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/cms/cms_kemri.c:CWE-119" + ], + "name": "openssl-cve-2026-63072-cms_kek_cipher", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4", + "cve": "CVE-2026-63073", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/cmp/cmp_vfy.c:CWE-119" + ], + "name": "openssl-cve-2026-63073", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76", + "cve": "CVE-2026-14457", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/t1_lib.c:CWE-119" + ], + "name": "openssl-cve-2026-14457", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f", + "cve": "CVE-2026-63074", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/cmp/cmp_vfy.c:CWE-119" + ], + "name": "openssl-cve-2026-63074", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393", + "cve": "CVE-2026-63075", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/quic/quic_txp.c:CWE-119" + ], + "name": "openssl-cve-2026-63075-txp_pkt_commit", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42", + "cve": "CVE-2026-75803", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_aes_ocb.c:CWE-119" + ], + "name": "openssl-cve-2026-75803", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42", + "cve": "CVE-2026-75803", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_chacha20_poly1305.c:CWE-119" + ], + "name": "openssl-cve-2026-75803-chacha20_poly1305_cipher", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9", + "cve": "CVE-2026-75803", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:CWE-119" + ], + "name": "openssl-cve-2026-75803-aes_gcm_siv_finish", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", + "cve": "CVE-2026-14456", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/quic/quic_port.c:CWE-119" + ], + "name": "openssl-cve-2026-14456-port_default_packet_hand", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/9416706d408bb84deb7cee4647bff3045d2dc7ba", + "cve": "CVE-2026-14456", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/quic/quic_impl.c:CWE-119" + ], + "name": "openssl-cve-2026-14456-expect_quic_for_value", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/f4129fbe3cde786d363510069fe297234f99be8f", + "cve": "CVE-2026-45447", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "uaf" + ], + "misses": [ + "-:crypto/pkcs7/pk7_smime.c:CWE-416" + ], + "name": "openssl-cve-2026-45447", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/609bcb24866d64f1fc49d38b852edbb39057d721", + "cve": "CVE-2026-45446", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:46", + "c-unsafe-memory-copy:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:63", + "c-unsafe-memory-copy:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:78" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:CWE-119" + ], + "name": "openssl-cve-2026-45446", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/609bcb24866d64f1fc49d38b852edbb39057d721", + "cve": "CVE-2026-45446", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_aes_siv.c:CWE-119" + ], + "name": "openssl-cve-2026-45446-aes_siv_set_ctx_params", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/f87f0b6a8e04bcdeb98afc82b0da06a2d537f399", + "cve": "CVE-2026-45445", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_aes_ocb.c:CWE-119" + ], + "name": "openssl-cve-2026-45445", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b3a555a0a7aa0028887149f6f973af89a4937bea", + "cve": "CVE-2026-42771", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/x509_vpm.c:CWE-119" + ], + "name": "openssl-cve-2026-42771", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/c2765d53c2649b56bc1ca1bb799e42002953056a", + "cve": "CVE-2026-42769", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/cmp/cmp_genm.c:CWE-476" + ], + "name": "openssl-cve-2026-42769", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/d5030cdf32d6cd27bd964a0cb7aed2b7cb713369", + "cve": "CVE-2026-42768", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/cms/cms_env.c:CWE-119" + ], + "name": "openssl-cve-2026-42768", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/d5030cdf32d6cd27bd964a0cb7aed2b7cb713369", + "cve": "CVE-2026-42768", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/pkcs7/pk7_doit.c:CWE-119" + ], + "name": "openssl-cve-2026-42768-pkcs7_decrypt_rinfo", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/74245170b5a64b234ac4af27c86a25ec251c8b2a", + "cve": "CVE-2026-42766", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/cms/cms_pwri.c:CWE-476" + ], + "name": "openssl-cve-2026-42766", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a9af3442290e8a04706a3cd5f284ffd5b486e3f6", + "cve": "CVE-2026-42765", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/x509/x509_vfy.c:CWE-476" + ], + "name": "openssl-cve-2026-42765", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/5097ec4dae239112498abb722e255ea60ef7ac48", + "cve": "CVE-2026-42764", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:ssl/quic/quic_port.c:CWE-476" + ], + "name": "openssl-cve-2026-42764", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/58633b658fe74095c8cdde191e4ce1bf94f8c5f9", + "cve": "CVE-2026-35188", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/x509_vfy.c:CWE-119" + ], + "name": "openssl-cve-2026-35188", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/5a0230b6cc95a576b0c2b7b5b2ba7c74232e7b7c", + "cve": "CVE-2026-34181", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/pkcs12/p12_mutl.c:CWE-119" + ], + "name": "openssl-cve-2026-34181", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/51d1800e95283a8beec85152e35e3634dab8dd82", + "cve": "CVE-2026-9076", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/cms/cms_pwri.c:61" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2026-9076", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/97f6b621f7af2c4c4e162c75045a6e12a8fdf8d9", + "cve": "CVE-2026-7383", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/asn1/a_mbstr.c:CWE-119" + ], + "name": "openssl-cve-2026-7383", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e", + "cve": "CVE-2026-31790", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/kem/rsa_kem.c:CWE-119" + ], + "name": "openssl-cve-2026-31790", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482", + "cve": "CVE-2026-31790", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "unknown", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/kem/rsa_kem.c.in:CWE-119" + ], + "name": "openssl-cve-2026-31790-rsasve_generate", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", + "cve": "CVE-2026-31789", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/o_str.c:CWE-119" + ], + "name": "openssl-cve-2026-31789", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", + "cve": "CVE-2026-28388", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/x509/x509_vfy.c:CWE-476" + ], + "name": "openssl-cve-2026-28388", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", + "cve": "CVE-2026-28389", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/cms/cms_rsa.c:CWE-476" + ], + "name": "openssl-cve-2026-28389", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", + "cve": "CVE-2026-28389", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/cms/cms_dh.c:CWE-476" + ], + "name": "openssl-cve-2026-28389-dh_cms_set_shared_info", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", + "cve": "CVE-2026-28389", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/cms/cms_ec.c:CWE-476" + ], + "name": "openssl-cve-2026-28389-ecdh_cms_set_shared_info", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34", + "cve": "CVE-2026-2673", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 2, + "fix_leaks": 2, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/t1_lib.c:102", + "c-unsafe-memory-copy:ssl/t1_lib.c:167" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/t1_lib.c:CWE-119" + ], + "name": "openssl-cve-2026-2673", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 2, + "unadjudicated_vuln": 2, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/4191043c36f1a50c717a2d0075fc6f3b9bc0afc5", + "cve": "CVE-2025-69419", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/pkcs12/p12_utl.c:CWE-119" + ], + "name": "openssl-cve-2025-69419", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347", + "cve": "CVE-2025-69418", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/modes/ocb128.c:57", + "c-unsafe-memory-copy:crypto/modes/ocb128.c:68", + "c-unsafe-memory-copy:crypto/modes/ocb128.c:93" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/modes/ocb128.c:CWE-119" + ], + "name": "openssl-cve-2025-69418", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4", + "cve": "CVE-2025-66199", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_lib.c:CWE-119" + ], + "name": "openssl-cve-2025-66199-tls13_process_compressed", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6", + "cve": "CVE-2025-68160", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 5, + "fix_leaks": 5, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:48", + "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:54", + "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:72", + "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:111", + "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:117" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2025-68160", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 5, + "unadjudicated_vuln": 4, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 4, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a7936fa4bd23c906e1955a16a0a0ab39a4953a61", + "cve": "CVE-2025-15469", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:apps/dgst.c:CWE-119" + ], + "name": "openssl-cve-2025-15469", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e", + "cve": "CVE-2025-15467", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/evp/evp_lib.c:26" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/evp/evp_lib.c:CWE-119" + ], + "name": "openssl-cve-2025-15467", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/205e3a55e16e4bd08c12fdbd3416ab829c0f6206", + "cve": "CVE-2025-11187", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/pkcs12/p12_mutl.c:CWE-119" + ], + "name": "openssl-cve-2025-11187", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b", + "cve": "CVE-2025-9232", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/http/http_lib.c:CWE-119" + ], + "name": "openssl-cve-2025-9232", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def", + "cve": "CVE-2025-9230", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/cms/cms_pwri.c:59" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2025-9230", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7", + "cve": "CVE-2024-12797", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_clnt.c:CWE-119" + ], + "name": "openssl-cve-2024-12797", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844", + "cve": "CVE-2024-13176", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/ec/ec_lib.c:CWE-119" + ], + "name": "openssl-cve-2024-13176-ec_field_inverse_mod_ord", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6", + "cve": "CVE-2024-6119", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_utl.c:CWE-119" + ], + "name": "openssl-cve-2024-6119", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/4b375b998798dd516d367036773073e1b88e6433", + "cve": "CVE-2024-5535", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/extensions_clnt.c:CWE-119" + ], + "name": "openssl-cve-2024-5535", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/189a7ed3e380e34ea38fe4190a7c9396bace0fb7", + "cve": "CVE-2024-5535", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/extensions_srvr.c:CWE-119" + ], + "name": "openssl-cve-2024-5535-tls_construct_stoc_next_", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/159921152fd4aa91e4c849fd281ad93ac0d0d0ba", + "cve": "CVE-2024-5535", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/statem/extensions_clnt.c:57" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/extensions_clnt.c:CWE-119" + ], + "name": "openssl-cve-2024-5535-tls_parse_stoc_npn", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c", + "cve": "CVE-2024-5535", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/ssl_lib.c:CWE-119" + ], + "name": "openssl-cve-2024-5535-ssl_select_next_proto", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/6cc511826f09e513b4ec066d9b95acaf4f86d991", + "cve": "CVE-2024-5535", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/quic/quic_tserver.c:CWE-119" + ], + "name": "openssl-cve-2024-5535-alpn_select_cb", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2d05959073c4bf8803401668b9df85931a08e020", + "cve": "CVE-2024-4741", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/record/rec_layer_s3.c:67" + ], + "mechanisms": [ + "uaf" + ], + "misses": [ + "-:ssl/record/rec_layer_s3.c:CWE-416" + ], + "name": "openssl-cve-2024-4741", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2d05959073c4bf8803401668b9df85931a08e020", + "cve": "CVE-2024-4741", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "uaf" + ], + "misses": [ + "-:ssl/record/ssl3_buffer.c:CWE-416" + ], + "name": "openssl-cve-2024-4741-ssl3_release_read_buffer", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d", + "cve": "CVE-2024-4741", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/ssl_lib.c:CWE-119" + ], + "name": "openssl-cve-2024-4741-ssl_free_buffers", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/10171e5b511b700c5ecd4fd3e1086b19c34b1ae3", + "cve": "CVE-2024-4741", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "uaf" + ], + "misses": [ + "-:ssl/record/methods/tls_common.c:CWE-416" + ], + "name": "openssl-cve-2024-4741-tls_release_read_buffer", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac", + "cve": "CVE-2024-4741", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/record/methods/tls_common.c:CWE-119" + ], + "name": "openssl-cve-2024-4741-tls_free_buffers", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397", + "cve": "CVE-2024-4603", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/dsa/dsa_check.c:CWE-119" + ], + "name": "openssl-cve-2024-4603", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d", + "cve": "CVE-2024-2511", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/ssl_lib.c:CWE-119" + ], + "name": "openssl-cve-2024-2511", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d", + "cve": "CVE-2024-2511", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_srvr.c:CWE-119" + ], + "name": "openssl-cve-2024-2511-tls_construct_server_hel", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2", + "cve": "CVE-2024-0727", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/pkcs12/p12_mutl.c:CWE-476" + ], + "name": "openssl-cve-2024-0727", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2", + "cve": "CVE-2024-0727", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/pkcs7/pk7_mime.c:CWE-476" + ], + "name": "openssl-cve-2024-0727-smime_write_pkcs7", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/0df40630850fb2740e6be6890bb905d3fc623b2d", + "cve": "CVE-2023-5363", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 5, + "fix_leaks": 5, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:173", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:181", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:332", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:333", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:345" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/evp/evp_enc.c:CWE-119" + ], + "name": "openssl-cve-2023-5363", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 5, + "unadjudicated_vuln": 3, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/9002fd07327a91f35ba6c1307e71fa6fd4409b7f", + "cve": "CVE-2023-3817", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/dh/dh_check.c:CWE-119" + ], + "name": "openssl-cve-2023-3817-dh_check", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/8780a896543a654e757db1b9396383f9d8095528", + "cve": "CVE-2023-3446", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/dh/dh_check.c:CWE-119" + ], + "name": "openssl-cve-2023-3446", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/00e2f5eea29994d19293ec4e8c8775ba73678598", + "cve": "CVE-2023-2975", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_aes_siv.c:CWE-119" + ], + "name": "openssl-cve-2023-2975", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/d63b3e7959e79f98d60760a739f7876dc5adc838", + "cve": "CVE-2023-2650", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/objects/obj_dat.c:CWE-119" + ], + "name": "openssl-cve-2023-2650", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/d12cde7fc5561d463badcd8a73079cf92864c31e", + "cve": "CVE-2022-37454", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:providers/implementations/kdfs/hkdf.c:68" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2022-37454", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a00d757d9ca212994625d1a02c81cc5edd27e13b", + "cve": "CVE-2022-4304", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/bn/bn_asm.c:CWE-119" + ], + "name": "openssl-cve-2022-4304", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a00d757d9ca212994625d1a02c81cc5edd27e13b", + "cve": "CVE-2022-4304", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/bn/bn_blind.c:CWE-119" + ], + "name": "openssl-cve-2022-4304-bn_blinding_invert_ex", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a00d757d9ca212994625d1a02c81cc5edd27e13b", + "cve": "CVE-2022-4304", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/rsa/rsa_ossl.c:CWE-119" + ], + "name": "openssl-cve-2022-4304-rsa_blinding_invert", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b013765abfa80036dc779dd0e50602c57bb3bf95", + "cve": "CVE-2023-0465", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/x509_vfy.c:CWE-119" + ], + "name": "openssl-cve-2023-0465", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/879f7080d7e141f415c79eaa3a8ac4a3dad0348b", + "cve": "CVE-2023-0464", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509v3/pcy_tree.c:CWE-119" + ], + "name": "openssl-cve-2023-0464", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/959c59c7a0164117e7f8366466a32bb1f8d77ff1", + "cve": "CVE-2023-0464", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/pcy_tree.c:CWE-119" + ], + "name": "openssl-cve-2023-0464-tree_init", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2b9e2afc382490592078cdb69d06f54f0fefd4c6", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/record/methods/tls_common.c:CWE-119" + ], + "name": "openssl-cve-2021-3449", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2b9e2afc382490592078cdb69d06f54f0fefd4c6", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/ssl_sess.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-def_generate_session_id", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2b9e2afc382490592078cdb69d06f54f0fefd4c6", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/extensions_srvr.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-tls_parse_ctos_renegotia", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2b9e2afc382490592078cdb69d06f54f0fefd4c6", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 2, + "fix_leaks": 2, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/statem/statem_lib.c:84", + "c-unsafe-memory-copy:ssl/statem/statem_lib.c:88" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_lib.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-tls_process_finished", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 2, + "unadjudicated_vuln": 2, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/6eebe6c0238178356114a96a7858f36b24172847", + "cve": "CVE-2023-0401", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/pkcs7/pk7_doit.c:CWE-119" + ], + "name": "openssl-cve-2023-0401", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7880536fe17c2b5450e279155bedd51771d28c9f", + "cve": "CVE-2023-0286", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_genn.c:CWE-119" + ], + "name": "openssl-cve-2023-0286-general_name_cmp", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/bcec03c33cc00a7b5eb89ebeeee59e604570a86a", + "cve": "CVE-2023-0217", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/ffc/ffc_key_validate.c:CWE-119" + ], + "name": "openssl-cve-2023-0217", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/80253dbdc92bec584f4a9866b43f8674156d838a", + "cve": "CVE-2023-0216", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/pkcs7/pk7_lib.c:CWE-119" + ], + "name": "openssl-cve-2023-0216", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/8022a4799fe884b3bf8d538e2b4c4ec323663118", + "cve": "CVE-2022-4304", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/rsa/rsa_ossl.c:134" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/rsa/rsa_ossl.c:CWE-119" + ], + "name": "openssl-cve-2022-4304-rsa_ossl_private_decrypt", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7fc67e0a33102aa47bbaa56533eeecb98c0450f7", + "cve": "CVE-2020-25659", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/rsa/rsa_ossl.c:217" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/rsa/rsa_ossl.c:CWE-119" + ], + "name": "openssl-cve-2020-25659", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7", + "cve": "CVE-2022-3996", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/pcy_map.c:CWE-119" + ], + "name": "openssl-cve-2022-3996", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/680e65b94c916af259bfdc2e25f1ab6e0c7a97d6", + "cve": "CVE-2022-3786", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/punycode.c:80" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [ + "-:crypto/punycode.c:CWE-119" + ], + "name": "openssl-cve-2022-3786-ossl_punycode_decode", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/3b421ebc64c7b52f1b9feb3812bdc7781c784332", + "cve": "CVE-2022-3602", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/punycode.c:81" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/punycode.c:CWE-119" + ], + "name": "openssl-cve-2022-3602-ossl_punycode_decode", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b", + "cve": "CVE-2022-3358", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/evp/digest.c:CWE-476" + ], + "name": "openssl-cve-2022-3358", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b", + "cve": "CVE-2022-3358", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:289", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:290", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:302" + ], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/evp/evp_enc.c:CWE-476" + ], + "name": "openssl-cve-2022-3358-evp_cipher_init_internal", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2c9c35870601b4a44d86ddbf512b38df38285cfa", + "cve": "CVE-2022-2068", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "unknown", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:tools/c_rehash.in:CWE-119" + ], + "name": "openssl-cve-2022-2068-hash_dir", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/373de40f3f76c63e4f2684abd86706f3863347ca", + "cve": "CVE-2022-29242", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_clnt.c:CWE-119" + ], + "name": "openssl-cve-2022-29242", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7d56a74a96828985db7354a55227a511615f732b", + "cve": "CVE-2022-1434", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/ciphers/cipher_rc4_hmac_md5.c:CWE-119" + ], + "name": "openssl-cve-2022-1434", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2eda98790c5c2741d76d23cc1e74b0dc4f4b391a", + "cve": "CVE-2022-1343", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/ocsp/ocsp_vfy.c:CWE-119" + ], + "name": "openssl-cve-2022-1343", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/d69ae8a93bfc0f2489c008fcf303a98d77a6df4d", + "cve": "CVE-2021-4044", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/x509_vfy.c:CWE-119" + ], + "name": "openssl-cve-2021-4044", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/758754966791c537ea95241438454aa86f91f256", + "cve": "CVE-2021-4044", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_clnt.c:CWE-119" + ], + "name": "openssl-cve-2021-4044-tls_post_process_server_", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/36cf45ef3ba71e44a8be06ee81cb31aa02cb0010", + "cve": "CVE-2021-3711", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:providers/implementations/asymciphers/sm2_enc.c:CWE-119" + ], + "name": "openssl-cve-2021-3711-sm2_asym_decrypt", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/7c038a6bcd98d4bbfd2c2892a87a1138d2f7c5f3", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/asn1/t_spki.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-netscape_spki_print", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/98624776c4d501c8badd6f772ab7048ac9191cb9", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_utl.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-append_ia5", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/95f8c1e142df835d03b5b62521383a462fc5470d", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/cmp/cmp_hdr.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-ossl_cmp_hdr_push1_freet", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/d2015a783e64613d8e4a142fa05048d1863df944", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_ncons.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-ia5ncasecmp", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/918430ba80d94ec8f05383b43b1872b1ebb13e1a", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_pci.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-i2r_pci", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/b2b3b9c9936b91315adc0f3254879cb2fd5ca2bd", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_san.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-general_name_print", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/1747d4658b3830951068a6a6c1fa2b45c4731fb3", + "cve": "CVE-2021-3712", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/v3_cpols.c:CWE-119" + ], + "name": "openssl-cve-2021-3712-print_qualifiers", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/59f5e75f3bced8fc0e130d72a3f582cf7b480b46", + "cve": "CVE-2021-3711", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/sm2/sm2_pmeth.c:CWE-119" + ], + "name": "openssl-cve-2021-3711-pkey_sm2_decrypt", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/39a140597d874e554b736885ac4dea16ac40a87a", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 2, + "fix_leaks": 2, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:ssl/s3_lib.c:39", + "c-unsafe-memory-copy:ssl/s3_lib.c:42" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/s3_lib.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-ssl_generate_master_secr", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 2, + "unadjudicated_vuln": 2, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/39a140597d874e554b736885ac4dea16ac40a87a", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/ssl_lib.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-ssl_ctx_set_alpn_protos", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/39a140597d874e554b736885ac4dea16ac40a87a", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/extensions.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-init_sig_algs_cert", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/39a140597d874e554b736885ac4dea16ac40a87a", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/extensions_clnt.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-tls_construct_ctos_early", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/39a140597d874e554b736885ac4dea16ac40a87a", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_clnt.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-tls_process_certificate_", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/39a140597d874e554b736885ac4dea16ac40a87a", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:ssl/statem/statem_srvr.c:CWE-119" + ], + "name": "openssl-cve-2021-3449-tls_handle_alpn", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/02b1636fe3db274497304a3e95a4e32ced7e841b", + "cve": "CVE-2021-3449", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:ssl/statem/extensions.c:CWE-476" + ], + "name": "openssl-cve-2021-3449-init_sig_algs", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/2a40b7bc7b94dd7de897a74571e7024f0cf0d63b", + "cve": "CVE-2021-3450", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509/x509_vfy.c:CWE-119" + ], + "name": "openssl-cve-2021-3450", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1", + "cve": "CVE-2021-23840", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:67", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:86", + "c-unsafe-memory-copy:crypto/evp/evp_enc.c:105" + ], + "mechanisms": [ + "unchecked_length_copy" + ], + "misses": [], + "name": "openssl-cve-2021-23840-evp_encryptdecryptupdate", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/122a19ab48091c657f7cb1fb3af9fc07bd557bbf", + "cve": "CVE-2021-23841", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:crypto/x509/x509_cmp.c:CWE-476" + ], + "name": "openssl-cve-2021-23841", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/f960d81215ebf3f65e03d4d5d857fb9b666d6920", + "cve": "CVE-2020-1971", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:crypto/x509v3/v3_genn.c:CWE-119" + ], + "name": "openssl-cve-2020-1971-general_name_cmp", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/openssl/openssl/commit/a87f3fe01a5a894aa27ccd6a239155fd129988e4", + "cve": "CVE-2020-1967", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "null_deref_unguarded" + ], + "misses": [ + "-:ssl/t1_lib.c:CWE-476" + ], + "name": "openssl-cve-2020-1967-tls1_check_sig_alg", + "origin": "openssl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/e9a2b0dc72dd3a9aa3a5210e89079a3b719475dc", + "cve": "CVE-2026-9080", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/multi_ev.c:CWE-119" + ], + "name": "curl-cve-2026-9080", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/fb4415d8aee6c1045be932a34fe6107c2f5ed147", + "cve": "CVE-2023-38545", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 5, + "fix_leaks": 5, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:lib/socks.c:197", + "c-unsafe-memory-copy:lib/socks.c:207", + "c-unsafe-memory-copy:lib/socks.c:360", + "c-unsafe-memory-copy:lib/socks.c:367", + "c-unsafe-memory-copy:lib/socks.c:373" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/socks.c:CWE-119" + ], + "name": "curl-cve-2023-38545-do_socks5", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 5, + "unadjudicated_vuln": 5, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 5, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/20f9dd6bae50b7223171b17ba7798946e74f877f", + "cve": "CVE-2022-32207", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/cookie.c:CWE-119" + ], + "name": "curl-cve-2022-32207", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/3a09fbb7f264c67c438d01a30669ce325aa508e2", + "cve": "CVE-2022-32206", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/content_encoding.c:CWE-119" + ], + "name": "curl-cve-2022-32206", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/6ecdf5136b52af747e7bda08db9a748256b1cd09", + "cve": "CVE-2022-32208", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/krb5.c:CWE-119" + ], + "name": "curl-cve-2022-32208", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c", + "cve": "CVE-2022-27782", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/url.c:CWE-119" + ], + "name": "curl-cve-2022-27782-curl_init_userdefined", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c", + "cve": "CVE-2022-27782", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/gtls.c:CWE-119" + ], + "name": "curl-cve-2022-27782-gtls_shutdown", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c", + "cve": "CVE-2022-27782", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 2, + "fix_leaks": 2, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-memory-copy:lib/vtls/nss.c:292", + "c-unsafe-memory-copy:lib/vtls/nss.c:297" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/nss.c:CWE-119" + ], + "name": "curl-cve-2022-27782-nss_setup_connect", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 2, + "unadjudicated_vuln": 2, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c", + "cve": "CVE-2022-27782", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-copy:lib/vtls/openssl.c:365", + "c-unsafe-memory-copy:lib/vtls/openssl.c:224", + "c-unsafe-memory-copy:lib/vtls/openssl.c:231" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/openssl.c:CWE-119" + ], + "name": "curl-cve-2022-27782-ossl_connect_step1", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c", + "cve": "CVE-2022-27782", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/vtls.c:CWE-119" + ], + "name": "curl-cve-2022-27782-curl_free_primary_ssl_co", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/8c7ee9083d0d719d0a77ab20d9cc2ae84eeea7f3", + "cve": "CVE-2022-27778", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:src/tool_operate.c:CWE-119" + ], + "name": "curl-cve-2022-27778", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/fae6fea209a2d4db1582f608bd8cc8000721733a", + "cve": "CVE-2022-30115", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/hsts.c:CWE-119" + ], + "name": "curl-cve-2022-30115", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/914aaab9153764ef8fa4178215b8ad89d3ac263a", + "cve": "CVE-2022-27780", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-copy:lib/urlapi.c:68" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/urlapi.c:CWE-119" + ], + "name": "curl-cve-2022-27780", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/620ea21410030a9977396b4661806bc187231b79", + "cve": "CVE-2022-27774", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/transfer.c:CWE-119" + ], + "name": "curl-cve-2022-27774", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/6e659993952aa5f90f48864be84a1bbb047fc258", + "cve": "CVE-2022-27776", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/http.c:CWE-119" + ], + "name": "curl-cve-2022-27776", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/058f98dc3fe595f21dc26a5b9b1699e519ba5705", + "cve": "CVE-2022-27775", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/conncache.c:CWE-119" + ], + "name": "curl-cve-2022-27775", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425", + "cve": "CVE-2022-22576", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/url.c:CWE-119" + ], + "name": "curl-cve-2022-22576-conn_free", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/8ef147c43646e91fdaad5d0e7b60351f842e5c68", + "cve": "CVE-2021-22947", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/ftp.c:CWE-119" + ], + "name": "curl-cve-2021-22947", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/8ef147c43646e91fdaad5d0e7b60351f842e5c68", + "cve": "CVE-2021-22947", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/imap.c:CWE-119" + ], + "name": "curl-cve-2021-22947-imap_state_starttls_resp", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/8ef147c43646e91fdaad5d0e7b60351f842e5c68", + "cve": "CVE-2021-22947", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/pop3.c:CWE-119" + ], + "name": "curl-cve-2021-22947-pop3_state_starttls_resp", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/8ef147c43646e91fdaad5d0e7b60351f842e5c68", + "cve": "CVE-2021-22947", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/smtp.c:CWE-119" + ], + "name": "curl-cve-2021-22947-smtp_state_starttls_resp", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca", + "cve": "CVE-2021-22946", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/ftp.c:CWE-119" + ], + "name": "curl-cve-2021-22946", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca", + "cve": "CVE-2021-22946", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/imap.c:CWE-119" + ], + "name": "curl-cve-2021-22946-imap_state_capability_re", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/364f174724ef115c63d5e5dc1d3342c8a43b1cca", + "cve": "CVE-2021-22946", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/pop3.c:CWE-119" + ], + "name": "curl-cve-2021-22946-pop3_state_capa_resp", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/43157490a5054bd24256fe12876931e8abc9df49", + "cve": "CVE-2021-22945", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/mqtt.c:CWE-119" + ], + "name": "curl-cve-2021-22945", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161", + "cve": "CVE-2021-22924", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/url.c:CWE-119" + ], + "name": "curl-cve-2021-22924", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161", + "cve": "CVE-2021-22924", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/nss.c:CWE-119" + ], + "name": "curl-cve-2021-22924-nss_do_connect", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161", + "cve": "CVE-2021-22924", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/openssl.c:CWE-119" + ], + "name": "curl-cve-2021-22924-servercert", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a", + "cve": "CVE-2021-22925", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/telnet.c:CWE-119" + ], + "name": "curl-cve-2021-22925", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479", + "cve": "CVE-2021-22901", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "c-unsafe-copy:lib/vtls/openssl.c:364", + "c-unsafe-memory-copy:lib/vtls/openssl.c:224", + "c-unsafe-memory-copy:lib/vtls/openssl.c:231" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/openssl.c:CWE-119" + ], + "name": "curl-cve-2021-22901-ossl_connect_step1", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 3, + "unadjudicated_vuln": 3, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde", + "cve": "CVE-2021-22898", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/telnet.c:CWE-119" + ], + "name": "curl-cve-2021-22898", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/b09c8ee15771c614c4bf3ddac893cdb12187c844", + "cve": "CVE-2021-22890", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/bearssl.c:CWE-119" + ], + "name": "curl-cve-2021-22890", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/7214288898f5625a6cc196e22a74232eada7861c", + "cve": "CVE-2021-22876", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/transfer.c:CWE-119" + ], + "name": "curl-cve-2021-22876", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/d9d01672785b8ac04aab1abb6de95fe3072ae199", + "cve": "CVE-2020-8286", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/vtls/openssl.c:CWE-119" + ], + "name": "curl-cve-2020-8286", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/ec9cc725d598ac77de7b6df8afeec292b3c8ad46", + "cve": "CVE-2020-8284", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/url.c:CWE-119" + ], + "name": "curl-cve-2020-8284", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 1, + "parse_failed_vuln": 1, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 1, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/ec9cc725d598ac77de7b6df8afeec292b3c8ad46", + "cve": "CVE-2020-8284", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:src/tool_cfgable.c:CWE-119" + ], + "name": "curl-cve-2020-8284-config_init", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/3c9e021f86872baae412a427e807fbfa2f3e8a22", + "cve": "CVE-2020-8231", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/multi.c:CWE-119" + ], + "name": "curl-cve-2020-8231-curl_multi_add_handle", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/3c9e021f86872baae412a427e807fbfa2f3e8a22", + "cve": "CVE-2020-8231", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "c_cpp", + "leaks": [], + "mechanisms": [ + "other" + ], + "misses": [ + "-:lib/url.c:CWE-119" + ], + "name": "curl-cve-2020-8231-curl_open", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/curl/curl/commit/8236aba58542c5f89f1d41ca09d84579efb05e22", + "cve": "CVE-2020-8177", + "detected_vuln": false, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "c_cpp", + "leaks": [ + "overlay-coverage:src/tool_cb_hdr.c:180:printf" + ], + "mechanisms": [ + "other" + ], + "misses": [ + "-:src/tool_cb_hdr.c:CWE-119" + ], + "name": "curl-cve-2020-8177", + "origin": "curl", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:core/views.py:CWE-78" + ], + "name": "damn-vulnerable-graphql-application-views-mutate", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "damn-vulnerable-graphql-application-views-resolve-pastes", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:core/views.py:CWE-78" + ], + "name": "damn-vulnerable-graphql-application-views-resolve-system-dia", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "djangoat-analytics-hits-by-ip", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "djangoat-views-reset-password", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "djangoat-views-user-view", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 5, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "dsvpwa-attacks-run", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:dsvpwa.py:CWE-326" + ], + "name": "dsvpwa-dsvpwa-main", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "dsvpwa-handlers-do-bdr", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", + "cve": "", + "detected_vuln": false, + "detection_kinds": [ + "promote" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": "identical_twin", + "language": "python", + "leaks": [ + "python-path-traversal:dsvw.py:26" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:dsvw.py:CWE-89" + ], + "name": "dsvw-dsvw-do-get", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": false, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 7, + "unadjudicated_vuln": 7, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:sqli/app.py:CWE-16" + ], + "name": "dvpwa-app-init", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:sqli/middlewares.py:CWE-1004" + ], + "name": "dvpwa-middlewares-session-middleware", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "dvpwa-student-create", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:routes/account.py:CWE-502" + ], + "name": "extremely-vulnerable-flask-app-account-before-request", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:routes/account.py:CWE-89" + ], + "name": "extremely-vulnerable-flask-app-account-search", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "extremely-vulnerable-flask-app-signup-validate-token", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", + "cve": "", + "detected_vuln": false, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": "identical_twin", + "language": "python", + "leaks": [ + "overlay-coverage:app/main.py:25:outbound.request" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:app/main.py:CWE-1336" + ], + "name": "python-insecure-app-main-try-hack-me", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": false, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": "identical_twin", + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:main.py:CWE-79" + ], + "name": "pythonssti-main-read-root", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "missing_auth_guard" + ], + "misses": [ + "-:server/api/v1/api_v1.py:CWE-862" + ], + "name": "threatbyte-api-v1-delete", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "missing_auth_guard" + ], + "misses": [ + "-:server/api/v1/api_v1.py:CWE-639" + ], + "name": "threatbyte-api-v1-get", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "threatbyte-routes-dashboard", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": "identical_twin", + "language": "python", + "leaks": [], + "mechanisms": [ + "missing_auth_guard" + ], + "misses": [ + "-:api_views/books.py:CWE-639" + ], + "name": "vampi-books-get-by-title", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vampi-user-model-get-user", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "missing_auth_guard" + ], + "misses": [ + "-:api_views/users.py:CWE-639" + ], + "name": "vampi-users-update-password", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:main.py:CWE-89" + ], + "name": "vfapi-main-delete-user", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", + "cve": "", + "detected_vuln": false, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:main.py:CWE-89" + ], + "name": "vfapi-main-put-user", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:main.py:CWE-89" + ], + "name": "vfapi-main-sql-return-users-from-username", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:Insecure_Frameworks/bad_mvc.py:CWE-79" + ], + "name": "vulnerable-python-apps-bad-mvc-do-get", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:Directory_Traversal/Dir_Traversal.py:CWE-22" + ], + "name": "vulnerable-python-apps-dir-traversal-do-get", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vulnpy-cmdi-do-os-system", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vulnpy-cmdi-do-subprocess-popen", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": "identical_twin", + "language": "python", + "leaks": [ + "python-unsafe-deserialization:src/vulnpy/trigger/deserialization.py:15" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vulnpy-deserialization-do-pickle-load", + "origin": "real-vuln-benchmark", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": false, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vulpy-libuser-create", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vulpy-libuser-login", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "vulpy-libuser-password-change", + "origin": "real-vuln-benchmark", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "seeded", + "silent_fix": true, + "slice": "vibe-py", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/simonh1000/angular-http-server/commit/8bafc9577161469f5dea01e0b98ea9c525d063e9", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:angular-http-server.js:CWE-22" + ], + "name": "angular-http-server-1-0-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/vincentmorneau/apex-publish-static-files/commit/2209af8f2b65c24aa55ab757e0e05b958c16f063", + "cve": "CVE-2018-16462", + "detected_vuln": true, + "detection_kinds": [ + "coverage", + "promote" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "overlay-coverage:index.js:22:prototype.merge" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "apex-publish-static-files-2-0-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6", + "cve": "CVE-2020-7730", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "bestzip-2-1-6", + "origin": "secbench.js", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/kylefarris/clamscan/commit/5f557c970817fe8c578ec3f7ad3bcbcef4cf5538", + "cve": "CVE-2020-7613", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:index.js:CWE-78" + ], + "name": "clamscan-1-2-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/iximiuz/node-diskusage-ng/commit/48e7e093486b528f0c81ec699573e0e4a431b8d3", + "cve": "CVE-2020-7631", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "diskusage-ng-0-2-6", + "origin": "secbench.js", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d", + "cve": "CVE-2014-9682", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "js-command-exec:lib/dns-sync.js:28" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "dns-sync-0-1-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19", + "cve": "CVE-2018-3715", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:index.js:CWE-22" + ], + "name": "glance-3-0-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e", + "cve": "CVE-2020-6836", + "detected_vuln": false, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:src/grammar-parser/grammar-parser.js:CWE-78" + ], + "name": "hot-formula-parser-3-0-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/jas-/node-libnmap/commit/c235b24b0342e12a5dbf502f89daabe95883b6c8", + "cve": "CVE-2018-16461", + "detected_vuln": false, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "overlay-coverage:lib/classes/tools.js:26:prototype.merge" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:lib/classes/tools.js:CWE-78" + ], + "name": "libnmap-0-4-11", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83", + "cve": "CVE-2018-3757", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "pdf-image-1-0-5", + "origin": "secbench.js", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 2, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d", + "cve": "CVE-2017-16034", + "detected_vuln": true, + "detection_kinds": [ + "coverage", + "promote" + ], + "fix_findings": 3, + "fix_leaks": 3, + "known_limit": null, + "language": "javascript", + "leaks": [ + "js-command-exec:lib/stats.js:119", + "overlay-coverage:lib/stats.js:29:path.open", + "overlay-coverage:lib/stats.js:61:path.open" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "pidusage-1-0-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 3, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1", + "cve": "CVE-2021-23348", + "detected_vuln": true, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "js-command-exec:index.js:21" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "portprocesses-1-0-4", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/ChristoPy/serve-here.js/commit/cefb51d03290b6a88dd13143ab2de31b8cf57c39", + "cve": "CVE-2019-5444", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:source/response.js:CWE-22" + ], + "name": "serve-here-js-1-1-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:index.js:CWE-94" + ], + "name": "static-eval-1-1-1", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a", + "cve": "CVE-2020-7677", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "thenify-3-3-0", + "origin": "secbench.js", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66", + "cve": "CVE-2021-23358", + "detected_vuln": false, + "detection_kinds": [ + "inventory" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "js-function-constructor:modules/template.js:63" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:modules/template.js:CWE-94" + ], + "name": "underscore-1-13-0-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "train", + "unadjudicated_fixed": 1, + "unadjudicated_vuln": 1, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b", + "cve": "CVE-2018-3772", + "detected_vuln": true, + "detection_kinds": [ + "promote" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "js-command-exec:index.js:23" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "whereis-0-4-0", + "origin": "secbench.js", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "human", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "vfc-js", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 4, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Anas329796/Anastasios/commit/14ec1ac50f9e4e255d875236d30129c6207401d4", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:extensions/browser/src/browser/pw-session.ts:CWE-918" + ], + "name": "anastasios-pw-session-14ec1a", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/P1R4N351/astroclaw/commit/1553a8adf123913cf7f1f1c75be4c4e5cd6c796b", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:extensions/browser/src/browser/pw-session.ts:CWE-918" + ], + "name": "astroclaw-pw-session-1553a8", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Cap-go/capgo.app/commit/4dadd2580d02213d227a331eee0232aa59859b59", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:supabase/functions/_backend/utils/hono.ts:CWE-16" + ], + "name": "capgo-app-hono-4dadd2", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/jfut/dnf-plugin-anyrepo/commit/26d19aeb8884f244e34ccfdc4f49f07055adc4d0", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:dnf_plugin_anyrepo/config.py:CWE-22" + ], + "name": "dnf-plugin-anyrepo-config-26d19a", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/jardimdesoftware/edutrace/commit/ee7ba25fb23ea89cc1b67549cb5e32c8ead92739", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:front/src/app/editar-anamnese/page.tsx:CWE-1321" + ], + "name": "edutrace-page-ee7ba2", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/c61a8bf78fe20d6ae0eab2e4b8b02004508525ed", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:src/config/editorConfig.ts:CWE-1321" + ], + "name": "etude-lexical-markdown-editorconfig-c61a8b", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dayflower/etude-lexical-markdown/commit/db4f54b1ab80ad596de6425e84f90aa781c49999", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:src/config/editorConfig.ts:CWE-1321" + ], + "name": "etude-lexical-markdown-editorconfig-db4f54", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": "client_side_caller", + "language": "typescript", + "leaks": [], + "mechanisms": [ + "missing_auth_guard" + ], + "misses": [ + "-:components/KubernetesManagement.tsx:CWE-862" + ], + "name": "lensops-kubernetesmanagement-fe4910", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/navaneethbv/market-cap/commit/4f8ae9be5519ced5a975f1190e3e4bc43f84e4d6", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 2, + "fix_leaks": 2, + "known_limit": null, + "language": "typescript", + "leaks": [ + "overlay-coverage:app/auth/confirm/route.ts:26:redirect", + "overlay-coverage:app/auth/confirm/route.ts:30:redirect" + ], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [], + "name": "market-cap-route-4f8ae9", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 1.0, + "review_tier": "title", + "silent_fix": false, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 2, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/alexshao3/melodix/commit/089931ef71ea1e5b7586520baf1a5498e2f05b13", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:apps/miniapp/src/components/PlayerProvider.tsx:CWE-16" + ], + "name": "melodix-playerprovider-089931", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/handielson/Mercado-do-vale-news/commit/9b5fcf2dae41e56f5f97952266f2d6ba59598598", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:services/catalogMetadataService.ts:CWE-16" + ], + "name": "mercado-do-vale-news-catalogmetadataservice-9b5fcf", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/andrebubniak/money-track/commit/4d4a5b063278c8b6697c3faae133d7c39fcd01c0", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:src/lib/category-icons.ts:CWE-1321" + ], + "name": "money-track-category-icons-4d4a5b", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/DavideCarvalho/nestjs-filter/commit/aa0e600d05997ea3d77538ea1c2db427c439f2e8", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:packages/core/src/input/normalizer.ts:CWE-1321" + ], + "name": "nestjs-filter-normalizer-aa0e60", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Sachin-Salgar/NEW_ERP_FINAL/commit/6e9644c81ce3fb356669157182a5ef09a70c4b59", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:src/presentation/http/app.ts:CWE-16" + ], + "name": "new-erp-final-app-6e9644", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Irnhakim/nimestream/commit/d17f535bf3012041b056ff3aa991ff6cfa198e43", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:app/api/img/route.js:CWE-918" + ], + "name": "nimestream-route-d17f53", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "identity_from_request_body" + ], + "misses": [ + "-:backend/app/routers/jobs.py:CWE-639" + ], + "name": "openniw-jobs-0fc947", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "identity_from_request_body" + ], + "misses": [ + "-:backend/app/routers/jobs.py:CWE-639" + ], + "name": "openniw-jobs-b74de3", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "identity_from_request_body" + ], + "misses": [ + "-:services/web/app/src/Features/Exports/ExportsController.mjs:CWE-639" + ], + "name": "overleaf-with-claude-exportscontroller-3980b9", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/dayflower/popmark/commit/e5ac407cef37c37178d440541ede301c838640fb", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:src/lexical-markdown/config/editorConfig.ts:CWE-1321" + ], + "name": "popmark-editorconfig-e5ac40", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/DevilsDev/rag-pipeline-utils/commit/76e5f0a94d6803d0e463d26a61cedb7da90857a7", + "cve": "", + "detected_vuln": false, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "overlay-coverage:src/cli/handlers/config-handler.js:15:path.open" + ], + "mechanisms": [ + "prototype_pollution" + ], + "misses": [ + "-:src/cli/handlers/config-handler.js:CWE-1321" + ], + "name": "rag-pipeline-utils-config-handler-76e5f0", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": false, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/agents-repo/registry-proxy/commit/426847899eb2ee94ae4e5a3aacc50423e36d2dc8", + "cve": "", + "detected_vuln": false, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "javascript", + "leaks": [ + "overlay-coverage:src/worker.js:30:prototype.merge" + ], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:src/worker.js:CWE-16" + ], + "name": "registry-proxy-worker-426847", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": false, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "identity_from_request_body" + ], + "misses": [ + "-:app/api/customers/claims/route.ts:CWE-639" + ], + "name": "supplieradvisor-mvp-route-387bcf", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "identity_from_request_body" + ], + "misses": [ + "-:app/api/customers/opportunities/route.ts:CWE-639" + ], + "name": "supplieradvisor-mvp-route-a69e8f", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/D-sorganization/Tools/commit/a96bc0502a3dcdac303e4f0152508886e5c35c0a", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:src/shared/python/ai/tools/cli_tools.py:CWE-78" + ], + "name": "tools-cli-tools-a96bc0", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/trackly-app/trackly-cli/commit/1c1aed89b07edb04051830c8f086e02b65e961c6", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "javascript", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:lib/path-diagnostics.js:CWE-22" + ], + "name": "trackly-cli-path-diagnostics-1c1aed", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/D-sorganization/UpstreamDrift/commit/c3a0787080489b30e2ed0abfac03b51e45da184b", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "path_join_user_input" + ], + "misses": [ + "-:src/api/local_server.py:CWE-22" + ], + "name": "upstreamdrift-local-server-c3a078", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/Ahkeratmehilaiset/waggledance-swarm/commit/9a454843aa35332ff2eb3106023eee0c4b5e444b", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "python", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:waggledance/core/v3_13_0/ssrf_host_guard.py:CWE-918" + ], + "name": "waggledance-swarm-ssrf-host-guard-9a4548", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/G4brym/workers-research/commit/209444eb61cc564c2d6b43267256f85fe3e5e30e", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "source_reaches_sink" + ], + "misses": [ + "-:src/utils.ts:CWE-89" + ], + "name": "workers-research-utils-209444", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "https://github.com/zoonk/zoonk/commit/bfbf670ccb41d63c407d32c51bd26e626a174f31", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "typescript", + "leaks": [], + "mechanisms": [ + "permissive_default" + ], + "misses": [ + "-:packages/utils/src/origin.ts:CWE-16" + ], + "name": "zoonk-origin-bfbf67", + "origin": "github-agent-trailer", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "agent", + "recall": 0.0, + "review_tier": "title", + "silent_fix": true, + "slice": "agent-vfc", + "split": "train", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00013.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00013", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00014.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00014", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00030.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00030", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00036.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00036", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00041.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00041.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00041", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00144.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00144", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00145.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00145", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00146.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00146", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00148.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00148", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00149.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00149", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00150.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00150", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00152.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00152.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00152", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00153.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00153", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00154.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00154.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00154", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00155.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00155", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00156.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00156", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00157", + "origin": "owasp-benchmark-java", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00276", + "origin": "owasp-benchmark-java", + "pair_correct": true, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00279.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00279.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00279", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00280.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00280.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00280", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00284.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00284", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00287.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00287", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00290.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00290", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00291.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00291", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": true, + "detection_kinds": [ + "coverage" + ], + "fix_findings": 1, + "fix_leaks": 1, + "known_limit": null, + "language": "java", + "leaks": [ + "overlay-coverage:testcode/BenchmarkTest00292.java:56:response.write" + ], + "mechanisms": [ + "container_taint" + ], + "misses": [], + "name": "owasp-xss-benchmarktest00292", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 1.0, + "review_tier": "advisory", + "silent_fix": false, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 1, + "vuln_matched": 1, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00301.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00301", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00375.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00375", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00376.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00376", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00378.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00378", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00380.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00380", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00382.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00382", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00383.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00383", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00384.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00384", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00385.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00385", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00387.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00387", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00388.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00388", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00390.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00390", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00392.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00392", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00395.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00395", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + }, + { + "commit_url": "", + "cve": "", + "detected_vuln": false, + "detection_kinds": [], + "fix_findings": 0, + "fix_leaks": 0, + "known_limit": null, + "language": "java", + "leaks": [], + "mechanisms": [ + "container_taint" + ], + "misses": [ + "-:testcode/BenchmarkTest00467.java:CWE-79" + ], + "name": "owasp-xss-benchmarktest00467", + "origin": "owasp-benchmark-java", + "pair_correct": false, + "parse_failed_fixed": 0, + "parse_failed_vuln": 0, + "provenance": "synthetic", + "recall": 0.0, + "review_tier": "advisory", + "silent_fix": true, + "slice": "owasp", + "split": "holdout", + "unadjudicated_fixed": 0, + "unadjudicated_vuln": 0, + "unresolved_labels": 0, + "unscorable": null, + "vuln_expected": 1, + "vuln_findings": 0, + "vuln_matched": 0, + "weak_labels": 0 + } + ], + "overall": { + "detected_vuln": 57, + "labeled_expected": 342, + "labeled_fix_leaks": 98, + "labeled_matched": 82, + "labeled_recall": 0.23976608187134502, + "pair_correct": 32, + "pair_pass_rate": 0.10094637223974763, + "pairs": 317, + "silent_fix": 256, + "specificity": 0.807570977917981, + "vuln_recall": 0.17981072555205047, + "youden": -0.012618296529968487 + }, + "per_mechanism": { + "config_sink_weak_literal": { + "detected_vuln": 0, + "labeled_expected": 1, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 1, + "silent_fix": 1, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "container_taint": { + "detected_vuln": 9, + "labeled_expected": 43, + "labeled_fix_leaks": 13, + "labeled_matched": 9, + "labeled_recall": 0.20930232558139536, + "pair_correct": 2, + "pair_pass_rate": 0.046511627906976744, + "pairs": 43, + "silent_fix": 30, + "specificity": 0.6976744186046512, + "vuln_recall": 0.20930232558139536, + "youden": -0.09302325581395346 + }, + "cross_artifact": { + "detected_vuln": 0, + "labeled_expected": 1, + "labeled_fix_leaks": 1, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 1, + "silent_fix": 0, + "specificity": 0.0, + "vuln_recall": 0.0, + "youden": -1.0 + }, + "fixed_buffer_capacity": { + "detected_vuln": 1, + "labeled_expected": 1, + "labeled_fix_leaks": 1, + "labeled_matched": 1, + "labeled_recall": 1.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 1, + "silent_fix": 0, + "specificity": 0.0, + "vuln_recall": 1.0, + "youden": 0.0 + }, + "identity_from_request_body": { + "detected_vuln": 0, + "labeled_expected": 5, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 5, + "silent_fix": 5, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "missing_auth_guard": { + "detected_vuln": 0, + "labeled_expected": 5, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 5, + "silent_fix": 5, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "null_deref_unguarded": { + "detected_vuln": 0, + "labeled_expected": 18, + "labeled_fix_leaks": 3, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 18, + "silent_fix": 17, + "specificity": 0.9444444444444444, + "vuln_recall": 0.0, + "youden": -0.05555555555555558 + }, + "other": { + "detected_vuln": 0, + "labeled_expected": 130, + "labeled_fix_leaks": 38, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 130, + "silent_fix": 112, + "specificity": 0.8615384615384616, + "vuln_recall": 0.0, + "youden": -0.1384615384615384 + }, + "path_join_user_input": { + "detected_vuln": 0, + "labeled_expected": 8, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 8, + "silent_fix": 8, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "permissive_default": { + "detected_vuln": 0, + "labeled_expected": 9, + "labeled_fix_leaks": 1, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 9, + "silent_fix": 8, + "specificity": 0.8888888888888888, + "vuln_recall": 0.0, + "youden": -0.11111111111111116 + }, + "prototype_pollution": { + "detected_vuln": 0, + "labeled_expected": 7, + "labeled_fix_leaks": 1, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 7, + "silent_fix": 6, + "specificity": 0.8571428571428571, + "vuln_recall": 0.0, + "youden": -0.1428571428571429 + }, + "signed_size_operand": { + "detected_vuln": 0, + "labeled_expected": 1, + "labeled_fix_leaks": 3, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 1, + "silent_fix": 0, + "specificity": 0.0, + "vuln_recall": 0.0, + "youden": -1.0 + }, + "source_reaches_sink": { + "detected_vuln": 38, + "labeled_expected": 87, + "labeled_fix_leaks": 15, + "labeled_matched": 63, + "labeled_recall": 0.7241379310344828, + "pair_correct": 30, + "pair_pass_rate": 0.4838709677419355, + "pairs": 62, + "silent_fix": 50, + "specificity": 0.8064516129032258, + "vuln_recall": 0.6129032258064516, + "youden": 0.4193548387096774 + }, + "type_confusion": { + "detected_vuln": 0, + "labeled_expected": 1, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 1, + "silent_fix": 1, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "uaf": { + "detected_vuln": 0, + "labeled_expected": 5, + "labeled_fix_leaks": 1, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 5, + "silent_fix": 4, + "specificity": 0.8, + "vuln_recall": 0.0, + "youden": -0.19999999999999996 + }, + "unchecked_alloc_size": { + "detected_vuln": 0, + "labeled_expected": 2, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 2, + "silent_fix": 2, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "unchecked_length_copy": { + "detected_vuln": 9, + "labeled_expected": 17, + "labeled_fix_leaks": 21, + "labeled_matched": 9, + "labeled_recall": 0.5294117647058824, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 17, + "silent_fix": 6, + "specificity": 0.35294117647058826, + "vuln_recall": 0.5294117647058824, + "youden": -0.11764705882352933 + }, + "validation_strength": { + "detected_vuln": 0, + "labeled_expected": 1, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 1, + "silent_fix": 1, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + } + }, + "per_profile": { + "agent": { + "detected_vuln": 1, + "labeled_expected": 29, + "labeled_fix_leaks": 4, + "labeled_matched": 1, + "labeled_recall": 0.034482758620689655, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 29, + "silent_fix": 26, + "specificity": 0.896551724137931, + "vuln_recall": 0.034482758620689655, + "youden": -0.0689655172413793 + }, + "human": { + "detected_vuln": 41, + "labeled_expected": 262, + "labeled_fix_leaks": 78, + "labeled_matched": 66, + "labeled_recall": 0.25190839694656486, + "pair_correct": 26, + "pair_pass_rate": 0.10970464135021098, + "pairs": 237, + "silent_fix": 195, + "specificity": 0.8227848101265823, + "vuln_recall": 0.1729957805907173, + "youden": -0.00421940928270037 + }, + "synthetic": { + "detected_vuln": 15, + "labeled_expected": 51, + "labeled_fix_leaks": 16, + "labeled_matched": 15, + "labeled_recall": 0.29411764705882354, + "pair_correct": 6, + "pair_pass_rate": 0.11764705882352941, + "pairs": 51, + "silent_fix": 35, + "specificity": 0.6862745098039216, + "vuln_recall": 0.29411764705882354, + "youden": -0.019607843137254888 + } + }, + "per_slice": { + "agent-vfc": { + "detected_vuln": 1, + "labeled_expected": 29, + "labeled_fix_leaks": 4, + "labeled_matched": 1, + "labeled_recall": 0.034482758620689655, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 29, + "silent_fix": 26, + "specificity": 0.896551724137931, + "vuln_recall": 0.034482758620689655, + "youden": -0.0689655172413793 + }, + "github": { + "detected_vuln": 4, + "labeled_expected": 6, + "labeled_fix_leaks": 0, + "labeled_matched": 4, + "labeled_recall": 0.6666666666666666, + "pair_correct": 4, + "pair_pass_rate": 0.6666666666666666, + "pairs": 6, + "silent_fix": 6, + "specificity": 1.0, + "vuln_recall": 0.6666666666666666, + "youden": 0.6666666666666666 + }, + "local": { + "detected_vuln": 3, + "labeled_expected": 28, + "labeled_fix_leaks": 0, + "labeled_matched": 28, + "labeled_recall": 1.0, + "pair_correct": 3, + "pair_pass_rate": 1.0, + "pairs": 3, + "silent_fix": 3, + "specificity": 1.0, + "vuln_recall": 1.0, + "youden": 1.0 + }, + "owasp": { + "detected_vuln": 9, + "labeled_expected": 40, + "labeled_fix_leaks": 12, + "labeled_matched": 9, + "labeled_recall": 0.225, + "pair_correct": 2, + "pair_pass_rate": 0.05, + "pairs": 40, + "silent_fix": 28, + "specificity": 0.7, + "vuln_recall": 0.225, + "youden": -0.07500000000000004 + }, + "sast": { + "detected_vuln": 6, + "labeled_expected": 11, + "labeled_fix_leaks": 4, + "labeled_matched": 6, + "labeled_recall": 0.5454545454545454, + "pair_correct": 4, + "pair_pass_rate": 0.36363636363636365, + "pairs": 11, + "silent_fix": 7, + "specificity": 0.6363636363636364, + "vuln_recall": 0.5454545454545454, + "youden": 0.18181818181818177 + }, + "vfc": { + "detected_vuln": 9, + "labeled_expected": 176, + "labeled_fix_leaks": 66, + "labeled_matched": 9, + "labeled_recall": 0.05113636363636364, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 176, + "silent_fix": 144, + "specificity": 0.8181818181818182, + "vuln_recall": 0.05113636363636364, + "youden": -0.13068181818181812 + }, + "vfc-js": { + "detected_vuln": 9, + "labeled_expected": 17, + "labeled_fix_leaks": 9, + "labeled_matched": 9, + "labeled_recall": 0.5294117647058824, + "pair_correct": 4, + "pair_pass_rate": 0.23529411764705882, + "pairs": 17, + "silent_fix": 10, + "specificity": 0.5882352941176471, + "vuln_recall": 0.5294117647058824, + "youden": 0.11764705882352944 + }, + "vibe-py": { + "detected_vuln": 16, + "labeled_expected": 35, + "labeled_fix_leaks": 3, + "labeled_matched": 16, + "labeled_recall": 0.45714285714285713, + "pair_correct": 15, + "pair_pass_rate": 0.42857142857142855, + "pairs": 35, + "silent_fix": 32, + "specificity": 0.9142857142857143, + "vuln_recall": 0.45714285714285713, + "youden": 0.3714285714285714 + } + }, + "per_tier": { + "advisory": { + "detected_vuln": 37, + "labeled_expected": 250, + "labeled_fix_leaks": 91, + "labeled_matched": 37, + "labeled_recall": 0.148, + "pair_correct": 14, + "pair_pass_rate": 0.056, + "pairs": 250, + "silent_fix": 195, + "specificity": 0.78, + "vuln_recall": 0.148, + "youden": -0.07199999999999998 + }, + "reviewed": { + "detected_vuln": 3, + "labeled_expected": 28, + "labeled_fix_leaks": 0, + "labeled_matched": 28, + "labeled_recall": 1.0, + "pair_correct": 3, + "pair_pass_rate": 1.0, + "pairs": 3, + "silent_fix": 3, + "specificity": 1.0, + "vuln_recall": 1.0, + "youden": 1.0 + }, + "seeded": { + "detected_vuln": 16, + "labeled_expected": 35, + "labeled_fix_leaks": 3, + "labeled_matched": 16, + "labeled_recall": 0.45714285714285713, + "pair_correct": 15, + "pair_pass_rate": 0.42857142857142855, + "pairs": 35, + "silent_fix": 32, + "specificity": 0.9142857142857143, + "vuln_recall": 0.45714285714285713, + "youden": 0.3714285714285714 + }, + "title": { + "detected_vuln": 1, + "labeled_expected": 29, + "labeled_fix_leaks": 4, + "labeled_matched": 1, + "labeled_recall": 0.034482758620689655, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 29, + "silent_fix": 26, + "specificity": 0.896551724137931, + "vuln_recall": 0.034482758620689655, + "youden": -0.0689655172413793 + } + }, + "scorers": { + "agent-vfc": { + "inventory": { + "detected_vuln": 0, + "labeled_expected": 29, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 29, + "silent_fix": 29, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "overlay": { + "detected_vuln": 1, + "labeled_expected": 29, + "labeled_fix_leaks": 4, + "labeled_matched": 1, + "labeled_recall": 0.034482758620689655, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 29, + "silent_fix": 26, + "specificity": 0.896551724137931, + "vuln_recall": 0.034482758620689655, + "youden": -0.0689655172413793 + } + }, + "owasp": { + "inventory": { + "detected_vuln": 0, + "labeled_expected": 40, + "labeled_fix_leaks": 0, + "labeled_matched": 0, + "labeled_recall": 0.0, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 40, + "silent_fix": 40, + "specificity": 1.0, + "vuln_recall": 0.0, + "youden": 0.0 + }, + "overlay": { + "detected_vuln": 9, + "labeled_expected": 40, + "labeled_fix_leaks": 12, + "labeled_matched": 9, + "labeled_recall": 0.225, + "pair_correct": 2, + "pair_pass_rate": 0.05, + "pairs": 40, + "silent_fix": 28, + "specificity": 0.7, + "vuln_recall": 0.225, + "youden": -0.07500000000000004 + } + }, + "sast": { + "inventory": { + "detected_vuln": 6, + "labeled_expected": 11, + "labeled_fix_leaks": 5, + "labeled_matched": 6, + "labeled_recall": 0.5454545454545454, + "pair_correct": 2, + "pair_pass_rate": 0.18181818181818182, + "pairs": 11, + "silent_fix": 6, + "specificity": 0.5454545454545454, + "vuln_recall": 0.5454545454545454, + "youden": 0.09090909090909083 + }, + "overlay": { + "detected_vuln": 6, + "labeled_expected": 11, + "labeled_fix_leaks": 4, + "labeled_matched": 6, + "labeled_recall": 0.5454545454545454, + "pair_correct": 4, + "pair_pass_rate": 0.36363636363636365, + "pairs": 11, + "silent_fix": 7, + "specificity": 0.6363636363636364, + "vuln_recall": 0.5454545454545454, + "youden": 0.18181818181818177 + } + }, + "vfc": { + "inventory": { + "detected_vuln": 9, + "labeled_expected": 176, + "labeled_fix_leaks": 65, + "labeled_matched": 9, + "labeled_recall": 0.05113636363636364, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 176, + "silent_fix": 145, + "specificity": 0.8238636363636364, + "vuln_recall": 0.05113636363636364, + "youden": -0.125 + }, + "overlay": { + "detected_vuln": 9, + "labeled_expected": 176, + "labeled_fix_leaks": 66, + "labeled_matched": 9, + "labeled_recall": 0.05113636363636364, + "pair_correct": 0, + "pair_pass_rate": 0.0, + "pairs": 176, + "silent_fix": 144, + "specificity": 0.8181818181818182, + "vuln_recall": 0.05113636363636364, + "youden": -0.13068181818181812 + } + }, + "vfc-js": { + "inventory": { + "detected_vuln": 9, + "labeled_expected": 17, + "labeled_fix_leaks": 5, + "labeled_matched": 9, + "labeled_recall": 0.5294117647058824, + "pair_correct": 5, + "pair_pass_rate": 0.29411764705882354, + "pairs": 17, + "silent_fix": 12, + "specificity": 0.7058823529411765, + "vuln_recall": 0.5294117647058824, + "youden": 0.23529411764705888 + }, + "overlay": { + "detected_vuln": 9, + "labeled_expected": 17, + "labeled_fix_leaks": 9, + "labeled_matched": 9, + "labeled_recall": 0.5294117647058824, + "pair_correct": 4, + "pair_pass_rate": 0.23529411764705882, + "pairs": 17, + "silent_fix": 10, + "specificity": 0.5882352941176471, + "vuln_recall": 0.5294117647058824, + "youden": 0.11764705882352944 + } + }, + "vibe-py": { + "inventory": { + "detected_vuln": 9, + "labeled_expected": 35, + "labeled_fix_leaks": 9, + "labeled_matched": 9, + "labeled_recall": 0.2571428571428571, + "pair_correct": 7, + "pair_pass_rate": 0.2, + "pairs": 35, + "silent_fix": 33, + "specificity": 0.9428571428571428, + "vuln_recall": 0.2571428571428571, + "youden": 0.19999999999999996 + }, + "overlay": { + "detected_vuln": 16, + "labeled_expected": 35, + "labeled_fix_leaks": 3, + "labeled_matched": 16, + "labeled_recall": 0.45714285714285713, + "pair_correct": 15, + "pair_pass_rate": 0.42857142857142855, + "pairs": 35, + "silent_fix": 32, + "specificity": 0.9142857142857143, + "vuln_recall": 0.45714285714285713, + "youden": 0.3714285714285714 + } + } + }, + "signals": [ + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22901-ossl_connect_step1", + "path": "c-unsafe-copy:lib/vtls/openssl.c:364", + "profile": "human", + "rule_id": "c-unsafe-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27780", + "path": "c-unsafe-copy:lib/urlapi.c:68", + "profile": "human", + "rule_id": "c-unsafe-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-ossl_connect_step1", + "path": "c-unsafe-copy:lib/vtls/openssl.c:365", + "profile": "human", + "rule_id": "c-unsafe-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "fixed_buffer_capacity" + ], + "pair": "juliet-c-cwe121-strcpy", + "path": "c-unsafe-copy:CWE121_char_declare_cpy_01.c:16", + "profile": "synthetic", + "rule_id": "c-unsafe-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22901-ossl_connect_step1", + "path": "c-unsafe-memory-copy:lib/vtls/openssl.c:224", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22901-ossl_connect_step1", + "path": "c-unsafe-memory-copy:lib/vtls/openssl.c:231", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-nss_setup_connect", + "path": "c-unsafe-memory-copy:lib/vtls/nss.c:292", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-nss_setup_connect", + "path": "c-unsafe-memory-copy:lib/vtls/nss.c:297", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-ossl_connect_step1", + "path": "c-unsafe-memory-copy:lib/vtls/openssl.c:224", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-ossl_connect_step1", + "path": "c-unsafe-memory-copy:lib/vtls/openssl.c:231", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "curl-cve-2023-38545", + "path": "c-unsafe-memory-copy:lib/socks.c:197", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "curl-cve-2023-38545", + "path": "c-unsafe-memory-copy:lib/socks.c:207", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "curl-cve-2023-38545", + "path": "c-unsafe-memory-copy:lib/socks.c:360", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "curl-cve-2023-38545", + "path": "c-unsafe-memory-copy:lib/socks.c:367", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "curl-cve-2023-38545", + "path": "c-unsafe-memory-copy:lib/socks.c:373", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2023-38545-do_socks5", + "path": "c-unsafe-memory-copy:lib/socks.c:197", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2023-38545-do_socks5", + "path": "c-unsafe-memory-copy:lib/socks.c:207", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2023-38545-do_socks5", + "path": "c-unsafe-memory-copy:lib/socks.c:360", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2023-38545-do_socks5", + "path": "c-unsafe-memory-copy:lib/socks.c:367", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2023-38545-do_socks5", + "path": "c-unsafe-memory-copy:lib/socks.c:373", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "firefox-cve-2020-15667", + "path": "c-unsafe-memory-copy:modules/libmar/src/mar_read.c:46", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2014-0160", + "path": "c-unsafe-memory-copy:ssl/t1_lib.c:80", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2020-25659", + "path": "c-unsafe-memory-copy:crypto/rsa/rsa_ossl.c:217", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "signed_size_operand" + ], + "pair": "openssl-cve-2021-23840", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:60", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "signed_size_operand" + ], + "pair": "openssl-cve-2021-23840", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:78", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "signed_size_operand" + ], + "pair": "openssl-cve-2021-23840", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:97", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2021-23840-evp_encryptdecryptupdate", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:67", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2021-23840-evp_encryptdecryptupdate", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:86", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2021-23840-evp_encryptdecryptupdate", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:105", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-ssl_generate_master_secr", + "path": "c-unsafe-memory-copy:ssl/s3_lib.c:39", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-ssl_generate_master_secr", + "path": "c-unsafe-memory-copy:ssl/s3_lib.c:42", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_process_finished", + "path": "c-unsafe-memory-copy:ssl/statem/statem_lib.c:84", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_process_finished", + "path": "c-unsafe-memory-copy:ssl/statem/statem_lib.c:88", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2022-3358-evp_cipher_init_internal", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:289", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2022-3358-evp_cipher_init_internal", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:290", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2022-3358-evp_cipher_init_internal", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:302", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2022-3602", + "path": "c-unsafe-memory-copy:crypto/punycode.c:81", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-3602-ossl_punycode_decode", + "path": "c-unsafe-memory-copy:crypto/punycode.c:81", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2022-37454", + "path": "c-unsafe-memory-copy:providers/implementations/kdfs/hkdf.c:68", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2022-3786", + "path": "c-unsafe-memory-copy:crypto/punycode.c:80", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2022-3786-ossl_punycode_decode", + "path": "c-unsafe-memory-copy:crypto/punycode.c:80", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-4304-rsa_ossl_private_decrypt", + "path": "c-unsafe-memory-copy:crypto/rsa/rsa_ossl.c:134", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-5363", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:173", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-5363", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:181", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-5363", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:332", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-5363", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:333", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-5363", + "path": "c-unsafe-memory-copy:crypto/evp/evp_enc.c:345", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "uaf" + ], + "pair": "openssl-cve-2024-4741", + "path": "c-unsafe-memory-copy:ssl/record/rec_layer_s3.c:67", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-5535-tls_parse_stoc_npn", + "path": "c-unsafe-memory-copy:ssl/statem/extensions_clnt.c:57", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-15467", + "path": "c-unsafe-memory-copy:crypto/evp/evp_lib.c:26", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-68160", + "path": "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:48", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-68160", + "path": "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:54", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-68160", + "path": "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:72", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-68160", + "path": "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:111", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-68160", + "path": "c-unsafe-memory-copy:crypto/bio/bf_lbuf.c:117", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-69418", + "path": "c-unsafe-memory-copy:crypto/modes/ocb128.c:57", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-69418", + "path": "c-unsafe-memory-copy:crypto/modes/ocb128.c:68", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-69418", + "path": "c-unsafe-memory-copy:crypto/modes/ocb128.c:93", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-9230", + "path": "c-unsafe-memory-copy:crypto/cms/cms_pwri.c:59", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-2673", + "path": "c-unsafe-memory-copy:ssl/t1_lib.c:102", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-2673", + "path": "c-unsafe-memory-copy:ssl/t1_lib.c:167", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-45446", + "path": "c-unsafe-memory-copy:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:46", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-45446", + "path": "c-unsafe-memory-copy:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:63", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-45446", + "path": "c-unsafe-memory-copy:providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c:78", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-54874-dtls_rlayer_buffer_recor", + "path": "c-unsafe-memory-copy:ssl/record/methods/dtls_meth.c:44", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2026-9076", + "path": "c-unsafe-memory-copy:crypto/cms/cms_pwri.c:61", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "dns-sync-0-1-0", + "path": "js-command-exec:lib/dns-sync.js:28", + "profile": "human", + "rule_id": "js-command-exec", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "pidusage-1-0-0", + "path": "js-command-exec:lib/stats.js:119", + "profile": "human", + "rule_id": "js-command-exec", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "portprocesses-1-0-4", + "path": "js-command-exec:index.js:21", + "profile": "human", + "rule_id": "js-command-exec", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "whereis-0-4-0", + "path": "js-command-exec:index.js:23", + "profile": "human", + "rule_id": "js-command-exec", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "underscore-1-13-0-0", + "path": "js-function-constructor:modules/template.js:63", + "profile": "human", + "rule_id": "js-function-constructor", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "apex-publish-static-files-2-0-0", + "path": "overlay-coverage:index.js:22:prototype.merge", + "profile": "human", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8177", + "path": "overlay-coverage:src/tool_cb_hdr.c:180:printf", + "profile": "human", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "libnmap-0-4-11", + "path": "overlay-coverage:lib/classes/tools.js:26:prototype.merge", + "profile": "human", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "market-cap-route-4f8ae9", + "path": "overlay-coverage:app/auth/confirm/route.ts:26:redirect", + "profile": "agent", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "market-cap-route-4f8ae9", + "path": "overlay-coverage:app/auth/confirm/route.ts:30:redirect", + "profile": "agent", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "owasp-java-sqli", + "path": "overlay-coverage:org/owasp/benchmark/testcode/BenchmarkTest00008.java:54:executeQuery", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00036", + "path": "overlay-coverage:testcode/BenchmarkTest00036.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00041", + "path": "overlay-coverage:testcode/BenchmarkTest00041.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00152", + "path": "overlay-coverage:testcode/BenchmarkTest00152.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00154", + "path": "overlay-coverage:testcode/BenchmarkTest00154.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00155", + "path": "overlay-coverage:testcode/BenchmarkTest00155.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00279", + "path": "overlay-coverage:testcode/BenchmarkTest00279.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00280", + "path": "overlay-coverage:testcode/BenchmarkTest00280.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00284", + "path": "overlay-coverage:testcode/BenchmarkTest00284.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00287", + "path": "overlay-coverage:testcode/BenchmarkTest00287.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00290", + "path": "overlay-coverage:testcode/BenchmarkTest00290.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00291", + "path": "overlay-coverage:testcode/BenchmarkTest00291.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00292", + "path": "overlay-coverage:testcode/BenchmarkTest00292.java:56:response.write", + "profile": "synthetic", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "pidusage-1-0-0", + "path": "overlay-coverage:lib/stats.js:29:path.open", + "profile": "human", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "pidusage-1-0-0", + "path": "overlay-coverage:lib/stats.js:61:path.open", + "profile": "human", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "prototype_pollution" + ], + "pair": "rag-pipeline-utils-config-handler-76e5f0", + "path": "overlay-coverage:src/cli/handlers/config-handler.js:15:path.open", + "profile": "agent", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "mechanisms": [ + "permissive_default" + ], + "pair": "registry-proxy-worker-426847", + "path": "overlay-coverage:src/worker.js:30:prototype.merge", + "profile": "agent", + "rule_id": "overlay-coverage", + "side": "fixed", + "signal": "fp", + "split": "holdout" + }, + { + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-python-cmdi", + "path": "python-shell-true:testcode/BenchmarkTest00165.py:58", + "profile": "synthetic", + "rule_id": "python-shell-true", + "side": "fixed", + "signal": "fp", + "split": "train" + }, + { + "cwe": "CWE-918", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "anastasios-pw-session-14ec1a", + "path": "extensions/browser/src/browser/pw-session.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "angular-http-server-1-0-0", + "path": "angular-http-server.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-918", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "astroclaw-pw-session-1553a8", + "path": "extensions/browser/src/browser/pw-session.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "capgo-app-hono-4dadd2", + "path": "supabase/functions/_backend/utils/hono.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-20", + "mechanisms": [ + "validation_strength" + ], + "pair": "chromium-cve-2022-2162", + "path": "content/browser/file_system_access/file_system_chooser.cc", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "clamscan-1-2-0", + "path": "index.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8177", + "path": "src/tool_cb_hdr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8231-curl_multi_add_handle", + "path": "lib/multi.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8231-curl_open", + "path": "lib/url.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8284", + "path": "lib/url.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8284-config_init", + "path": "src/tool_cfgable.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2020-8286", + "path": "lib/vtls/openssl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22876", + "path": "lib/transfer.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22890", + "path": "lib/vtls/bearssl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22898", + "path": "lib/telnet.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22901-ossl_connect_step1", + "path": "lib/vtls/openssl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22924", + "path": "lib/url.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22924-nss_do_connect", + "path": "lib/vtls/nss.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22924-servercert", + "path": "lib/vtls/openssl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22925", + "path": "lib/telnet.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22945", + "path": "lib/mqtt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22946", + "path": "lib/ftp.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22946-imap_state_capability_re", + "path": "lib/imap.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22946-pop3_state_capa_resp", + "path": "lib/pop3.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22947", + "path": "lib/ftp.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22947-imap_state_starttls_resp", + "path": "lib/imap.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22947-pop3_state_starttls_resp", + "path": "lib/pop3.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2021-22947-smtp_state_starttls_resp", + "path": "lib/smtp.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-22576-conn_free", + "path": "lib/url.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27774", + "path": "lib/transfer.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27775", + "path": "lib/conncache.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27776", + "path": "lib/http.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27778", + "path": "src/tool_operate.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27780", + "path": "lib/urlapi.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-curl_free_primary_ssl_co", + "path": "lib/vtls/vtls.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-curl_init_userdefined", + "path": "lib/url.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-gtls_shutdown", + "path": "lib/vtls/gtls.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-nss_setup_connect", + "path": "lib/vtls/nss.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-27782-ossl_connect_step1", + "path": "lib/vtls/openssl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-30115", + "path": "lib/hsts.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-32206", + "path": "lib/content_encoding.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-32207", + "path": "lib/cookie.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2022-32208", + "path": "lib/krb5.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2023-38545-do_socks5", + "path": "lib/socks.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "curl-cve-2026-9080", + "path": "lib/multi_ev.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "damn-vulnerable-graphql-application-views-mutate", + "path": "core/views.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", + "path": "core/views.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "dnf-plugin-anyrepo-config-26d19a", + "path": "dnf_plugin_anyrepo/config.py", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-326", + "mechanisms": [ + "permissive_default" + ], + "pair": "dsvpwa-dsvpwa-main", + "path": "dsvpwa.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "dvpwa-app-init", + "path": "sqli/app.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-1004", + "mechanisms": [ + "permissive_default" + ], + "pair": "dvpwa-middlewares-session-middleware", + "path": "sqli/middlewares.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "edutrace-page-ee7ba2", + "path": "front/src/app/editar-anamnese/page.tsx", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "etude-lexical-markdown-editorconfig-c61a8b", + "path": "src/config/editorConfig.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "etude-lexical-markdown-editorconfig-db4f54", + "path": "src/config/editorConfig.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-502", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "extremely-vulnerable-flask-app-account-before-request", + "path": "routes/account.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "extremely-vulnerable-flask-app-account-search", + "path": "routes/account.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-770", + "mechanisms": [ + "unchecked_alloc_size" + ], + "pair": "firefox-bug-2058173", + "path": "modules/libmar/src/mar_read.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "glance-3-0-0", + "path": "index.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "hot-formula-parser-3-0-0", + "path": "src/grammar-parser/grammar-parser.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "hutool-cve-2018-17297", + "path": "cn/hutool/core/util/ZipUtil.java", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "libnmap-0-4-11", + "path": "lib/classes/tools.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "melodix-playerprovider-089931", + "path": "apps/miniapp/src/components/PlayerProvider.tsx", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf", + "path": "services/catalogMetadataService.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "money-track-category-icons-4d4a5b", + "path": "src/lib/category-icons.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "nestjs-filter-normalizer-aa0e60", + "path": "packages/core/src/input/normalizer.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "new-erp-final-app-6e9644", + "path": "src/presentation/http/app.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-918", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "nimestream-route-d17f53", + "path": "app/api/img/route.js", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "identity_from_request_body" + ], + "pair": "openniw-jobs-0fc947", + "path": "backend/app/routers/jobs.py", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "identity_from_request_body" + ], + "pair": "openniw-jobs-b74de3", + "path": "backend/app/routers/jobs.py", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2020-1967", + "path": "ssl/t1_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2020-1967-tls1_check_sig_alg", + "path": "ssl/t1_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2020-1971", + "path": "crypto/x509/v3_genn.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2020-1971-general_name_cmp", + "path": "crypto/x509v3/v3_genn.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2020-25659", + "path": "crypto/rsa/rsa_ossl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-190", + "mechanisms": [ + "signed_size_operand" + ], + "pair": "openssl-cve-2021-23840", + "path": "crypto/evp/evp_enc.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2021-23841", + "path": "crypto/x509/x509_cmp.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449", + "path": "ssl/record/methods/tls_common.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-def_generate_session_id", + "path": "ssl/ssl_sess.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2021-3449-init_sig_algs", + "path": "ssl/statem/extensions.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-init_sig_algs_cert", + "path": "ssl/statem/extensions.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-ssl_ctx_set_alpn_protos", + "path": "ssl/ssl_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-ssl_generate_master_secr", + "path": "ssl/s3_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_construct_ctos_early", + "path": "ssl/statem/extensions_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_handle_alpn", + "path": "ssl/statem/statem_srvr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_parse_ctos_renegotia", + "path": "ssl/statem/extensions_srvr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_process_certificate_", + "path": "ssl/statem/statem_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3449-tls_process_finished", + "path": "ssl/statem/statem_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3450", + "path": "crypto/x509/x509_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-120", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2021-3711", + "path": "crypto/sm2/sm2_crypt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3711-pkey_sm2_decrypt", + "path": "crypto/sm2/sm2_pmeth.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3711-sm2_asym_decrypt", + "path": "providers/implementations/asymciphers/sm2_enc.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-125", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2021-3712", + "path": "crypto/x509/v3_utl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-append_ia5", + "path": "crypto/x509/v3_utl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-general_name_print", + "path": "crypto/x509/v3_san.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-i2r_pci", + "path": "crypto/x509/v3_pci.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-ia5ncasecmp", + "path": "crypto/x509/v3_ncons.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-netscape_spki_print", + "path": "crypto/asn1/t_spki.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-ossl_cmp_hdr_push1_freet", + "path": "crypto/cmp/cmp_hdr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-3712-print_qualifiers", + "path": "crypto/x509/v3_cpols.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-4044", + "path": "crypto/x509/x509_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2021-4044-tls_post_process_server_", + "path": "ssl/statem/statem_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-835", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-0778", + "path": "crypto/bn/bn_sqrt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "openssl-cve-2022-1292", + "path": "tools/c_rehash.in", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-1343", + "path": "crypto/ocsp/ocsp_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-1434", + "path": "providers/implementations/ciphers/cipher_rc4_hmac_md5.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-2068-hash_dir", + "path": "tools/c_rehash.in", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-29242", + "path": "ssl/statem/statem_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2022-3358", + "path": "crypto/evp/digest.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2022-3358-evp_cipher_init_internal", + "path": "crypto/evp/evp_enc.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-3602-ossl_punycode_decode", + "path": "crypto/punycode.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2022-3786-ossl_punycode_decode", + "path": "crypto/punycode.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-3996", + "path": "crypto/x509/pcy_map.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-4304", + "path": "crypto/bn/bn_asm.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-4304-bn_blinding_invert_ex", + "path": "crypto/bn/bn_blind.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-4304-rsa_blinding_invert", + "path": "crypto/rsa/rsa_ossl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2022-4304-rsa_ossl_private_decrypt", + "path": "crypto/rsa/rsa_ossl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0216", + "path": "crypto/pkcs7/pk7_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0217", + "path": "crypto/ffc/ffc_key_validate.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-843", + "mechanisms": [ + "type_confusion" + ], + "pair": "openssl-cve-2023-0286", + "path": "crypto/x509/v3_genn.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0286-general_name_cmp", + "path": "crypto/x509/v3_genn.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0401", + "path": "crypto/pkcs7/pk7_doit.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0464", + "path": "crypto/x509v3/pcy_tree.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0464-tree_init", + "path": "crypto/x509/pcy_tree.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-0465", + "path": "crypto/x509/x509_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-2650", + "path": "crypto/objects/obj_dat.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-2975", + "path": "providers/implementations/ciphers/cipher_aes_siv.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-3446", + "path": "crypto/dh/dh_check.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-3817-dh_check", + "path": "crypto/dh/dh_check.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2023-5363", + "path": "crypto/evp/evp_enc.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2024-0727", + "path": "crypto/pkcs12/p12_mutl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2024-0727-smime_write_pkcs7", + "path": "crypto/pkcs7/pk7_mime.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-12797", + "path": "ssl/statem/statem_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-13176-ec_field_inverse_mod_ord", + "path": "crypto/ec/ec_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-2511", + "path": "ssl/ssl_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-2511-tls_construct_server_hel", + "path": "ssl/statem/statem_srvr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-4603", + "path": "crypto/dsa/dsa_check.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-416", + "mechanisms": [ + "uaf" + ], + "pair": "openssl-cve-2024-4741", + "path": "ssl/record/rec_layer_s3.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-416", + "mechanisms": [ + "uaf" + ], + "pair": "openssl-cve-2024-4741-ssl3_release_read_buffer", + "path": "ssl/record/ssl3_buffer.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-4741-ssl_free_buffers", + "path": "ssl/ssl_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-4741-tls_free_buffers", + "path": "ssl/record/methods/tls_common.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-416", + "mechanisms": [ + "uaf" + ], + "pair": "openssl-cve-2024-4741-tls_release_read_buffer", + "path": "ssl/record/methods/tls_common.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-5535", + "path": "ssl/statem/extensions_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-5535-alpn_select_cb", + "path": "ssl/quic/quic_tserver.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-5535-ssl_select_next_proto", + "path": "ssl/ssl_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-5535-tls_construct_stoc_next_", + "path": "ssl/statem/extensions_srvr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-5535-tls_parse_stoc_npn", + "path": "ssl/statem/extensions_clnt.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2024-6119", + "path": "crypto/x509/v3_utl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-11187", + "path": "crypto/pkcs12/p12_mutl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-15467", + "path": "crypto/evp/evp_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-15469", + "path": "apps/dgst.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-770", + "mechanisms": [ + "unchecked_alloc_size" + ], + "pair": "openssl-cve-2025-66199", + "path": "ssl/statem/statem_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-66199-tls13_process_compressed", + "path": "ssl/statem/statem_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-69418", + "path": "crypto/modes/ocb128.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2025-69419", + "path": "crypto/pkcs12/p12_utl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2025-69421", + "path": "crypto/pkcs12/p12_decr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2025-9232", + "path": "crypto/http/http_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-14456-expect_quic_for_value", + "path": "ssl/quic/quic_impl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-14456-port_default_packet_hand", + "path": "ssl/quic/quic_port.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-14457", + "path": "ssl/t1_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-18798", + "path": "ssl/quic/quic_port.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-2673", + "path": "ssl/t1_lib.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-28388", + "path": "crypto/x509/x509_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-28389", + "path": "crypto/cms/cms_rsa.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-28389-dh_cms_set_shared_info", + "path": "crypto/cms/cms_dh.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-28389-ecdh_cms_set_shared_info", + "path": "crypto/cms/cms_ec.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2026-31789", + "path": "crypto/o_str.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-31790", + "path": "providers/implementations/kem/rsa_kem.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-31790-rsasve_generate", + "path": "providers/implementations/kem/rsa_kem.c.in", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-34181", + "path": "crypto/pkcs12/p12_mutl.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-35188", + "path": "crypto/x509/x509_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-42764", + "path": "ssl/quic/quic_port.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-42765", + "path": "crypto/x509/x509_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-42766", + "path": "crypto/cms/cms_pwri.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-42768", + "path": "crypto/cms/cms_env.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-42768-pkcs7_decrypt_rinfo", + "path": "crypto/pkcs7/pk7_doit.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-476", + "mechanisms": [ + "null_deref_unguarded" + ], + "pair": "openssl-cve-2026-42769", + "path": "crypto/cmp/cmp_genm.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-42771", + "path": "crypto/x509/x509_vpm.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-45445", + "path": "providers/implementations/ciphers/cipher_aes_ocb.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-45446", + "path": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-45446-aes_siv_set_ctx_params", + "path": "providers/implementations/ciphers/cipher_aes_siv.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-416", + "mechanisms": [ + "uaf" + ], + "pair": "openssl-cve-2026-45447", + "path": "crypto/pkcs7/pk7_smime.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-54874", + "path": "ssl/record/rec_layer_d1.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-54874-dtls1_process_record", + "path": "ssl/record/ssl3_record.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-54874-dtls_rlayer_buffer_recor", + "path": "ssl/record/methods/dtls_meth.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2026-63072", + "path": "crypto/cms/cms_kari.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "openssl-cve-2026-63072-cms_kek_cipher", + "path": "crypto/cms/cms_kemri.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-63073", + "path": "crypto/cmp/cmp_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-63074", + "path": "crypto/cmp/cmp_vfy.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-63075-txp_pkt_commit", + "path": "ssl/quic/quic_txp.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-7383", + "path": "crypto/asn1/a_mbstr.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-75803", + "path": "providers/implementations/ciphers/cipher_aes_ocb.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-75803-aes_gcm_siv_finish", + "path": "providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-119", + "mechanisms": [ + "other" + ], + "pair": "openssl-cve-2026-75803-chacha20_poly1305_cipher", + "path": "providers/implementations/ciphers/cipher_chacha20_poly1305.c", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "identity_from_request_body" + ], + "pair": "overleaf-with-claude-exportscontroller-3980b9", + "path": "services/web/app/src/Features/Exports/ExportsController.mjs", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00013", + "path": "testcode/BenchmarkTest00013.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00014", + "path": "testcode/BenchmarkTest00014.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00030", + "path": "testcode/BenchmarkTest00030.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00041", + "path": "testcode/BenchmarkTest00041.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00144", + "path": "testcode/BenchmarkTest00144.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00145", + "path": "testcode/BenchmarkTest00145.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00146", + "path": "testcode/BenchmarkTest00146.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00148", + "path": "testcode/BenchmarkTest00148.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00149", + "path": "testcode/BenchmarkTest00149.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00150", + "path": "testcode/BenchmarkTest00150.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00152", + "path": "testcode/BenchmarkTest00152.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00153", + "path": "testcode/BenchmarkTest00153.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00154", + "path": "testcode/BenchmarkTest00154.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00156", + "path": "testcode/BenchmarkTest00156.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00279", + "path": "testcode/BenchmarkTest00279.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00280", + "path": "testcode/BenchmarkTest00280.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00301", + "path": "testcode/BenchmarkTest00301.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00375", + "path": "testcode/BenchmarkTest00375.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00376", + "path": "testcode/BenchmarkTest00376.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00378", + "path": "testcode/BenchmarkTest00378.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00380", + "path": "testcode/BenchmarkTest00380.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00382", + "path": "testcode/BenchmarkTest00382.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00383", + "path": "testcode/BenchmarkTest00383.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00384", + "path": "testcode/BenchmarkTest00384.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00385", + "path": "testcode/BenchmarkTest00385.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00387", + "path": "testcode/BenchmarkTest00387.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00388", + "path": "testcode/BenchmarkTest00388.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00390", + "path": "testcode/BenchmarkTest00390.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00392", + "path": "testcode/BenchmarkTest00392.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00395", + "path": "testcode/BenchmarkTest00395.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-xss-benchmarktest00467", + "path": "testcode/BenchmarkTest00467.java", + "profile": "synthetic", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "popmark-editorconfig-e5ac40", + "path": "src/lexical-markdown/config/editorConfig.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-1321", + "mechanisms": [ + "prototype_pollution" + ], + "pair": "rag-pipeline-utils-config-handler-76e5f0", + "path": "src/cli/handlers/config-handler.js", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "registry-proxy-worker-426847", + "path": "src/worker.js", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "serve-here-js-1-1-0", + "path": "source/response.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-94", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "static-eval-1-1-1", + "path": "index.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "identity_from_request_body" + ], + "pair": "supplieradvisor-mvp-route-387bcf", + "path": "app/api/customers/claims/route.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "identity_from_request_body" + ], + "pair": "supplieradvisor-mvp-route-a69e8f", + "path": "app/api/customers/opportunities/route.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "sven-cwe-089-query-concat", + "path": "modules/query_lastfm.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-862", + "mechanisms": [ + "missing_auth_guard" + ], + "pair": "threatbyte-api-v1-delete", + "path": "server/api/v1/api_v1.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "missing_auth_guard" + ], + "pair": "threatbyte-api-v1-get", + "path": "server/api/v1/api_v1.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "tools-cli-tools-a96bc0", + "path": "src/shared/python/ai/tools/cli_tools.py", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "trackly-cli-path-diagnostics-1c1aed", + "path": "lib/path-diagnostics.js", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-94", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "underscore-1-13-0-0", + "path": "modules/template.js", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "upstreamdrift-local-server-c3a078", + "path": "src/api/local_server.py", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-639", + "mechanisms": [ + "missing_auth_guard" + ], + "pair": "vampi-users-update-password", + "path": "api_views/users.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "vfapi-main-delete-user", + "path": "main.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "vfapi-main-put-user", + "path": "main.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "vfapi-main-sql-return-users-from-username", + "path": "main.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-79", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "vulnerable-python-apps-bad-mvc-do-get", + "path": "Insecure_Frameworks/bad_mvc.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-22", + "mechanisms": [ + "path_join_user_input" + ], + "pair": "vulnerable-python-apps-dir-traversal-do-get", + "path": "Directory_Traversal/Dir_Traversal.py", + "profile": "human", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-918", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "waggledance-swarm-ssrf-host-guard-9a4548", + "path": "waggledance/core/v3_13_0/ssrf_host_guard.py", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "source_reaches_sink" + ], + "pair": "workers-research-utils-209444", + "path": "src/utils.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-16", + "mechanisms": [ + "permissive_default" + ], + "pair": "zoonk-origin-bfbf67", + "path": "packages/utils/src/origin.ts", + "profile": "agent", + "rule_id": "", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-416", + "mechanisms": [ + "uaf" + ], + "pair": "chromium-cve-2019-5786", + "path": "third_party/blink/renderer/core/fileapi/file_reader_loader.cc", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-122", + "mechanisms": [ + "unchecked_length_copy" + ], + "pair": "curl-cve-2023-38545", + "path": "lib/socks.c", + "profile": "human", + "rule_id": "c-unsafe-memory-copy", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-78", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-python-cmdi", + "path": "testcode/BenchmarkTest00165.py", + "profile": "synthetic", + "rule_id": "python-shell-true", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-89", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-python-sqli", + "path": "testcode/BenchmarkTest00099.py", + "profile": "synthetic", + "rule_id": "python-sql-injection", + "signal": "miss", + "split": "holdout" + }, + { + "cwe": "CWE-94", + "mechanisms": [ + "container_taint" + ], + "pair": "owasp-python-codeinj", + "path": "testcode/BenchmarkTest00074.py", + "profile": "synthetic", + "rule_id": "python-unsafe-eval", + "signal": "miss", + "split": "train" + }, + { + "cwe": "CWE-327", + "mechanisms": [ + "config_sink_weak_literal" + ], + "pair": "owasp-python-hash", + "path": "testcode/BenchmarkTest00054.py", + "profile": "synthetic", + "rule_id": "python-weak-hash", + "signal": "miss", + "split": "holdout" + } + ] +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/findings.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/findings.json new file mode 100644 index 0000000..ab18eae --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/findings.json @@ -0,0 +1,630 @@ +{ + "findings": [ + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-flask-debug:app.py:81", + "function_name": null, + "line": 81, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 1.5, + "rationale": "Static pattern python-flask-debug (CWE-489) matched debug on line 81; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "insecure_default", + "syscall_entry" + ], + "title": "Flask debug mode enabled needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-os-command:app.py:17", + "function_name": "ping", + "line": 17, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-os-command (CWE-78) matched os.system on line 17; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/ping')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 17, + "function_name": "ping", + "kind": "route", + "line": 15, + "name": "ping", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "critical", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Python OS command execution needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-path-traversal:app.py:55", + "function_name": "read", + "line": 55, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-path-traversal (CWE-22) matched open on line 55; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/read')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 55, + "function_name": "read", + "kind": "route", + "line": 54, + "name": "read", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Python file open with external input needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-shell-true:app.py:23", + "function_name": "run", + "line": 23, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-shell-true (CWE-78) matched subprocess.check_output on line 23; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/run')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 23, + "function_name": "run", + "kind": "route", + "line": 21, + "name": "run", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "critical", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Subprocess shell execution needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:44", + "function_name": "user", + "line": 44, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 44; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/user')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 44, + "function_name": "user", + "kind": "route", + "line": 42, + "name": "user", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "high", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "injection", + "syscall_entry" + ], + "title": "Python SQL string composition needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:50", + "function_name": "report", + "line": 50, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 50; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/report')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 50, + "function_name": "report", + "kind": "route", + "line": 48, + "name": "report", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "high", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "injection", + "syscall_entry" + ], + "title": "Python SQL string composition needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-ssrf:app.py:60", + "function_name": "fetch", + "line": 60, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-ssrf (CWE-918) matched requests.get on line 60; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/fetch')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 60, + "function_name": "fetch", + "kind": "route", + "line": 59, + "name": "fetch", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "network_entry", + "syscall_entry" + ], + "title": "Python outbound request with external input needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-ssti:app.py:70", + "function_name": "render", + "line": 70, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-ssti (CWE-94) matched render_template_string on line 70; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/render')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 70, + "function_name": "render", + "kind": "route", + "line": 69, + "name": "render", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "injection", + "syscall_entry" + ], + "title": "Python server-side template injection needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:33", + "function_name": "load", + "line": 33, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-unsafe-deserialization (CWE-502) matched pickle.loads on line 33; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/load')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 33, + "function_name": "load", + "kind": "route", + "line": 32, + "name": "load", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Unsafe Python deserialization needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:38", + "function_name": "config", + "line": 38, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-unsafe-deserialization (CWE-502) matched yaml.load on line 38; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/config')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 38, + "function_name": "config", + "kind": "route", + "line": 37, + "name": "config", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Unsafe Python deserialization needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-eval:app.py:28", + "function_name": "calc", + "line": 28, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-unsafe-eval (CWE-95) matched eval on line 28; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/calc')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 28, + "function_name": "calc", + "kind": "route", + "line": 27, + "name": "calc", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "critical", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Dynamic Python execution needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "python-weak-hash:app.py:65", + "function_name": "token", + "line": 65, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 3.8, + "rationale": "Static pattern python-weak-hash (CWE-327) matched md5 on line 65; manual verification still required.", + "reachability_conditions": [], + "reachability_evidence": [ + { + "access_declared": false, + "access_evidence": [ + "app.get('/token')" + ], + "access_level": "public", + "conditions": [], + "defines_handler": true, + "end_line": 65, + "function_name": "token", + "kind": "route", + "line": 64, + "name": "token", + "path": "app.py", + "provenance": "entrypoint:route:public", + "rationale": "route surface classified as public at http_request", + "registered_by": "", + "trust_boundary": "http_request" + } + ], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "status": "enabled", + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ], + "title": "Python weak hash needs review" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "overlay-coverage:app.py:77:execute", + "function_name": null, + "line": 77, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 0.0, + "rationale": "uninventoried sink execute reached from request", + "reachability_conditions": [], + "reachability_evidence": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "status": "enabled", + "tags": [ + "overlay-originated" + ], + "title": "Overlay coverage: execute" + }, + { + "confidence": "medium", + "evidence_level": "static_corroboration", + "finding_id": "overlay-coverage:safe.py:11:os.system", + "function_name": null, + "line": 11, + "path": "safe.py", + "proposed_snippet": null, + "ranking_priority": 0.0, + "rationale": "uninventoried sink os.system reached from parameter", + "reachability_conditions": [], + "reachability_evidence": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "critical", + "status": "enabled", + "tags": [ + "overlay-originated" + ], + "title": "Overlay coverage: os.system" + }, + { + "confidence": "low", + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:44:identity_constraint", + "function_name": "user", + "line": 44, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 0.3, + "rationale": "protected_read on users in user is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", + "reachability_conditions": [], + "reachability_evidence": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "status": "enabled", + "tags": [ + "obligation:protected_read", + "discharger:identity_constraint", + "obligation_evidence:function_local", + "resource:users" + ], + "title": "Obligation not discharged: protected_read on users without identity_constraint" + }, + { + "confidence": "low", + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:50:identity_constraint", + "function_name": "report", + "line": 50, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 0.3, + "rationale": "protected_read on reports in report is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", + "reachability_conditions": [], + "reachability_evidence": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "status": "enabled", + "tags": [ + "obligation:protected_read", + "discharger:identity_constraint", + "obligation_evidence:function_local", + "resource:reports" + ], + "title": "Obligation not discharged: protected_read on reports without identity_constraint" + }, + { + "confidence": "low", + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:77:identity_constraint", + "function_name": "search", + "line": 77, + "path": "app.py", + "proposed_snippet": null, + "ranking_priority": 0.3, + "rationale": "protected_read on a resource in search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.", + "reachability_conditions": [], + "reachability_evidence": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "status": "enabled", + "tags": [ + "obligation:protected_read", + "discharger:identity_constraint", + "obligation_evidence:function_local" + ], + "title": "Obligation not discharged: protected_read on a resource without identity_constraint" + } + ] +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/fusion.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/fusion.json new file mode 100644 index 0000000..0560f5a --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/fusion.json @@ -0,0 +1,192 @@ +[ + { + "decision_source": "deterministic-reconciler", + "degradations": [], + "disposition": "accepted", + "finding_id": "python-os-command:app.py:17", + "model_ids": [], + "panels": [ + { + "confidence": 0.75, + "disposition": "accepted", + "false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.", + "leaning": "vulnerability", + "model_id": null, + "rationale": "reachability=reachable, severity=critical, verified=True", + "role": "panel_a", + "vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached." + }, + { + "confidence": 0.6, + "disposition": "accepted", + "false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "leaning": "false_positive", + "model_id": null, + "rationale": "reachable=True, rejected=False, verified=True", + "role": "panel_b", + "vulnerability_case": "A tainted sink shape exists in the source." + } + ], + "triggered": true, + "triggers": [ + "gates_risky_fix", + "severity:critical" + ], + "votes": { + "accepted": 2 + }, + "warnings": [] + }, + { + "decision_source": "deterministic-reconciler", + "degradations": [], + "disposition": "accepted", + "finding_id": "python-shell-true:app.py:23", + "model_ids": [], + "panels": [ + { + "confidence": 0.75, + "disposition": "accepted", + "false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.", + "leaning": "vulnerability", + "model_id": null, + "rationale": "reachability=reachable, severity=critical, verified=True", + "role": "panel_a", + "vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached." + }, + { + "confidence": 0.6, + "disposition": "accepted", + "false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "leaning": "false_positive", + "model_id": null, + "rationale": "reachable=True, rejected=False, verified=True", + "role": "panel_b", + "vulnerability_case": "A tainted sink shape exists in the source." + } + ], + "triggered": true, + "triggers": [ + "gates_risky_fix", + "severity:critical" + ], + "votes": { + "accepted": 2 + }, + "warnings": [] + }, + { + "decision_source": "deterministic-reconciler", + "degradations": [], + "disposition": "accepted", + "finding_id": "python-sql-injection:app.py:44", + "model_ids": [], + "panels": [ + { + "confidence": 0.75, + "disposition": "accepted", + "false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.", + "leaning": "vulnerability", + "model_id": null, + "rationale": "reachability=reachable, severity=high, verified=True", + "role": "panel_a", + "vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached." + }, + { + "confidence": 0.6, + "disposition": "accepted", + "false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "leaning": "false_positive", + "model_id": null, + "rationale": "reachable=True, rejected=False, verified=True", + "role": "panel_b", + "vulnerability_case": "A tainted sink shape exists in the source." + } + ], + "triggered": true, + "triggers": [ + "gates_risky_fix", + "severity:high" + ], + "votes": { + "accepted": 2 + }, + "warnings": [] + }, + { + "decision_source": "deterministic-reconciler", + "degradations": [], + "disposition": "accepted", + "finding_id": "python-sql-injection:app.py:50", + "model_ids": [], + "panels": [ + { + "confidence": 0.75, + "disposition": "accepted", + "false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.", + "leaning": "vulnerability", + "model_id": null, + "rationale": "reachability=reachable, severity=high, verified=True", + "role": "panel_a", + "vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached." + }, + { + "confidence": 0.6, + "disposition": "accepted", + "false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "leaning": "false_positive", + "model_id": null, + "rationale": "reachable=True, rejected=False, verified=True", + "role": "panel_b", + "vulnerability_case": "A tainted sink shape exists in the source." + } + ], + "triggered": true, + "triggers": [ + "gates_risky_fix", + "severity:high" + ], + "votes": { + "accepted": 2 + }, + "warnings": [] + }, + { + "decision_source": "deterministic-reconciler", + "degradations": [], + "disposition": "accepted", + "finding_id": "python-unsafe-eval:app.py:28", + "model_ids": [], + "panels": [ + { + "confidence": 0.75, + "disposition": "accepted", + "false_positive_case": "Reachability or sanitizer evidence could still neutralize the sink.", + "leaning": "vulnerability", + "model_id": null, + "rationale": "reachability=reachable, severity=critical, verified=True", + "role": "panel_a", + "vulnerability_case": "Static corroboration exists and function-level reachability evidence is attached." + }, + { + "confidence": 0.6, + "disposition": "accepted", + "false_positive_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "leaning": "false_positive", + "model_id": null, + "rationale": "reachable=True, rejected=False, verified=True", + "role": "panel_b", + "vulnerability_case": "A tainted sink shape exists in the source." + } + ], + "triggered": true, + "triggers": [ + "gates_risky_fix", + "severity:critical" + ], + "votes": { + "accepted": 2 + }, + "warnings": [] + } +] diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/harness.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/harness.json new file mode 100644 index 0000000..1e7a0dc --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/harness.json @@ -0,0 +1,11 @@ +{ + "contract_mode": "strict", + "model_roles": { + "hunter": null, + "patcher": null, + "ranker": null, + "verifier": null + }, + "processor_versions": {}, + "prompt_hashes": {} +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/manifest.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/manifest.json new file mode 100644 index 0000000..5043f9e --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/manifest.json @@ -0,0 +1,461 @@ +{ + "artifacts": { + "complexity_map": "complexity_map.json", + "findings": "findings.json", + "fusion": "fusion.json", + "markdown": "report.md", + "overlay": "overlay.json", + "sarif": "report.sarif", + "score": "score.json", + "trajectories": "traces/hunter_trajectories.jsonl", + "verification": "verification.json" + }, + "complexity": { + "heuristic_only": true, + "hotspot_count": 14 + }, + "degradations": [ + { + "detail": "no path records; obligations evaluated within entry-point handlers only", + "files": [ + "app.py", + "safe.py" + ], + "language": "python", + "reason": "obligations_function_local", + "stage": "obligations" + }, + { + "detail": "no hunter client or model", + "reason": "intent_adjudication_unavailable", + "stage": "obligations" + }, + { + "reason": "cpg_unavailable", + "stage": "model" + }, + { + "reason": "hunter_model_unavailable", + "stage": "map" + } + ], + "findings": [ + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-flask-debug:app.py:81", + "line": 81, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "rejected" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-os-command:app.py:17", + "line": 17, + "path": "app.py", + "rung": "suspicion", + "severity": "critical", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-path-traversal:app.py:55", + "line": 55, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-shell-true:app.py:23", + "line": 23, + "path": "app.py", + "rung": "suspicion", + "severity": "critical", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:44", + "line": 44, + "path": "app.py", + "rung": "suspicion", + "severity": "high", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:50", + "line": 50, + "path": "app.py", + "rung": "suspicion", + "severity": "high", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-ssrf:app.py:60", + "line": 60, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-ssti:app.py:70", + "line": 70, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:33", + "line": 33, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:38", + "line": 38, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-eval:app.py:28", + "line": 28, + "path": "app.py", + "rung": "suspicion", + "severity": "critical", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "python-weak-hash:app.py:65", + "line": 65, + "path": "app.py", + "rung": "suspicion", + "severity": "medium", + "verification_status": "accepted" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "overlay-coverage:app.py:77:execute", + "line": 77, + "path": "app.py", + "rung": "suspicion", + "severity": "high", + "verification_status": "not_run" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "static_corroboration", + "finding_id": "overlay-coverage:safe.py:11:os.system", + "line": 11, + "path": "safe.py", + "rung": "suspicion", + "severity": "critical", + "verification_status": "not_run" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:44:identity_constraint", + "line": 44, + "path": "app.py", + "rung": "suspicion", + "severity": "high", + "verification_status": "not_run" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:50:identity_constraint", + "line": 50, + "path": "app.py", + "rung": "suspicion", + "severity": "high", + "verification_status": "not_run" + }, + { + "artifact_refs": { + "findings_json": "findings.json", + "markdown": "report.md", + "sarif": "report.sarif", + "trajectories_jsonl": "traces/hunter_trajectories.jsonl", + "verification_json": "verification.json" + }, + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:77:identity_constraint", + "line": 77, + "path": "app.py", + "rung": "suspicion", + "severity": "high", + "verification_status": "not_run" + } + ], + "fusion": [ + { + "decision_source": "deterministic-reconciler", + "disposition": "accepted", + "finding_id": "python-os-command:app.py:17", + "triggers": [ + "gates_risky_fix", + "severity:critical" + ] + }, + { + "decision_source": "deterministic-reconciler", + "disposition": "accepted", + "finding_id": "python-shell-true:app.py:23", + "triggers": [ + "gates_risky_fix", + "severity:critical" + ] + }, + { + "decision_source": "deterministic-reconciler", + "disposition": "accepted", + "finding_id": "python-sql-injection:app.py:44", + "triggers": [ + "gates_risky_fix", + "severity:high" + ] + }, + { + "decision_source": "deterministic-reconciler", + "disposition": "accepted", + "finding_id": "python-sql-injection:app.py:50", + "triggers": [ + "gates_risky_fix", + "severity:high" + ] + }, + { + "decision_source": "deterministic-reconciler", + "disposition": "accepted", + "finding_id": "python-unsafe-eval:app.py:28", + "triggers": [ + "gates_risky_fix", + "severity:critical" + ] + } + ], + "model": { + "by_rung": {}, + "cost_usd": 0.0, + "coverage": [], + "family_coverage": [], + "model_calls": 0, + "partitions": [], + "query_seconds_by_kind": {}, + "question_outcomes": [], + "regions_scanned": 0, + "regions_unasked": 0, + "regions_unjudged": 0, + "scope": null, + "seconds": 0.0, + "skipped": "cpg_unavailable", + "unjudged_sample": [] + }, + "obligations": { + "degradations": [ + { + "detail": "no path records; obligations evaluated within entry-point handlers only", + "files": [ + "app.py", + "safe.py" + ], + "language": "python", + "reason": "obligations_function_local", + "stage": "obligations" + }, + { + "detail": "no hunter client or model", + "reason": "intent_adjudication_unavailable", + "stage": "obligations" + } + ], + "findings_by_label": { + "function_local": 3 + }, + "operations": 4, + "policy_version": null, + "sets": [ + { + "handlers": 1, + "module": "app", + "resource": "reports" + }, + { + "handlers": 1, + "module": "app", + "resource": "users" + } + ], + "sibling_sets": 2, + "under_populated": 2 + }, + "provenance": { + "agent_commits": 0, + "sampled_commits": 0, + "signals": [ + "git:unavailable" + ], + "value": "human" + }, + "score": { + "by_category": { + "Code Injection": 2, + "Code Quality": 1, + "Command or Argument Injection": 2, + "Cryptographic Issues": 1, + "Directory Traversal": 1, + "Encapsulation": 2, + "Information Leakage": 1, + "SQL Injection": 2 + }, + "gate": { + "block_severity_reachable": 5, + "blocking": false, + "min_score": 80, + "passed": false + }, + "max_severity": 5, + "out_of_scope_dynamic_only": 0, + "penalty_total": 105.6, + "project_score": 17, + "unmapped_cwe": [] + }, + "stages": { + "completed": [ + "static", + "map" + ], + "requested": [ + "static", + "map" + ], + "skipped": [] + }, + "target": "/benchmarks/fixtures/python-vulnerable" +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/report.sarif b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/report.sarif new file mode 100644 index 0000000..92dfde4 --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/report.sarif @@ -0,0 +1,1076 @@ +{ + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "runs": [ + { + "results": [ + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 81 + } + } + } + ], + "message": { + "text": "Static pattern python-flask-debug (CWE-489) matched debug on line 81; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-flask-debug:app.py:81" + }, + "properties": { + "confidence": "medium", + "disposition": "unadjudicated", + "evidence_level": "static_corroboration", + "finding_id": "python-flask-debug:app.py:81", + "overlay_reason": "flow_incomplete", + "ranking_priority": 1.5, + "reachability_conditions": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "No function-level attacker-reachable entry point currently reaches this line.", + "evidence_level": "static_corroboration", + "finding_id": "python-flask-debug:app.py:81", + "pro_case": "A static pattern matched the source line.", + "required_next_step": "Add reachability evidence before prioritizing a fix.", + "status": "rejected", + "tie_breaker": "Provide call-graph, route, CLI, parser, or dynamic evidence linking attacker input to this function.", + "verified": false + } + }, + "ruleId": "python-flask-debug" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 17 + } + } + } + ], + "message": { + "text": "Static pattern python-os-command (CWE-78) matched os.system on line 17; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-os-command:app.py:17" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-os-command:app.py:17", + "overlay_reason": "request reaches os.system without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "critical", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-os-command:app.py:17", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-os-command" + }, + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 55 + } + } + } + ], + "message": { + "text": "Static pattern python-path-traversal (CWE-22) matched open on line 55; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-path-traversal:app.py:55" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-path-traversal:app.py:55", + "overlay_reason": "request reaches path.open without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-path-traversal:app.py:55", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-path-traversal" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 23 + } + } + } + ], + "message": { + "text": "Static pattern python-shell-true (CWE-78) matched subprocess.check_output on line 23; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-shell-true:app.py:23" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-shell-true:app.py:23", + "overlay_reason": "request reaches os.system without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "critical", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-shell-true:app.py:23", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-shell-true" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 44 + } + } + } + ], + "message": { + "text": "Static pattern python-sql-injection (CWE-89) matched .execute on line 44; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-sql-injection:app.py:44" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:44", + "overlay_reason": "request reaches execute without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "high", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:44", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-sql-injection" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 50 + } + } + } + ], + "message": { + "text": "Static pattern python-sql-injection (CWE-89) matched .execute on line 50; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-sql-injection:app.py:50" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:50", + "overlay_reason": "request reaches execute without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "high", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:50", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-sql-injection" + }, + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 60 + } + } + } + ], + "message": { + "text": "Static pattern python-ssrf (CWE-918) matched requests.get on line 60; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-ssrf:app.py:60" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-ssrf:app.py:60", + "overlay_reason": "request reaches outbound.request without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-ssrf:app.py:60", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-ssrf" + }, + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 70 + } + } + } + ], + "message": { + "text": "Static pattern python-ssti (CWE-94) matched render_template_string on line 70; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-ssti:app.py:70" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-ssti:app.py:70", + "overlay_reason": "request reaches html.unescaped without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-ssti:app.py:70", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-ssti" + }, + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 33 + } + } + } + ], + "message": { + "text": "Static pattern python-unsafe-deserialization (CWE-502) matched pickle.loads on line 33; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-unsafe-deserialization:app.py:33" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:33", + "overlay_reason": "request reaches pickle.loads without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:33", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-unsafe-deserialization" + }, + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 38 + } + } + } + ], + "message": { + "text": "Static pattern python-unsafe-deserialization (CWE-502) matched yaml.load on line 38; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-unsafe-deserialization:app.py:38" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:38", + "overlay_reason": "request reaches pickle.loads without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:38", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-unsafe-deserialization" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 28 + } + } + } + ], + "message": { + "text": "Static pattern python-unsafe-eval (CWE-95) matched eval on line 28; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-unsafe-eval:app.py:28" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-eval:app.py:28", + "overlay_reason": "request reaches eval without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "critical", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-eval:app.py:28", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-unsafe-eval" + }, + { + "level": "warning", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 65 + } + } + } + ], + "message": { + "text": "Static pattern python-weak-hash (CWE-327) matched md5 on line 65; manual verification still required." + }, + "partialFingerprints": { + "openultrasastFindingId": "python-weak-hash:app.py:65" + }, + "properties": { + "confidence": "medium", + "disposition": "promote", + "evidence_level": "static_corroboration", + "finding_id": "python-weak-hash:app.py:65", + "overlay_reason": "request reaches hashlib without a dominating sanitizer", + "ranking_priority": 3.8, + "reachability_conditions": [], + "reachability_status": "reachable", + "rung": "suspicion", + "severity": "medium", + "verification": { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-weak-hash:app.py:65", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + }, + "ruleId": "python-weak-hash" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 77 + } + } + } + ], + "message": { + "text": "uninventoried sink execute reached from request" + }, + "partialFingerprints": { + "openultrasastFindingId": "overlay-coverage:app.py:77:execute" + }, + "properties": { + "confidence": "medium", + "disposition": "coverage", + "evidence_level": "static_corroboration", + "finding_id": "overlay-coverage:app.py:77:execute", + "overlay_reason": "uninventoried sink execute reached from request", + "ranking_priority": 0.0, + "reachability_conditions": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "verification": null + }, + "ruleId": "overlay-coverage" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "safe.py" + }, + "region": { + "startLine": 11 + } + } + } + ], + "message": { + "text": "uninventoried sink os.system reached from parameter" + }, + "partialFingerprints": { + "openultrasastFindingId": "overlay-coverage:safe.py:11:os.system" + }, + "properties": { + "confidence": "medium", + "disposition": "coverage", + "evidence_level": "static_corroboration", + "finding_id": "overlay-coverage:safe.py:11:os.system", + "overlay_reason": "uninventoried sink os.system reached from parameter", + "ranking_priority": 0.0, + "reachability_conditions": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "critical", + "verification": null + }, + "ruleId": "overlay-coverage" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 44 + } + } + } + ], + "message": { + "text": "protected_read on users in user is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local." + }, + "partialFingerprints": { + "openultrasastFindingId": "obligation:protected_read:app.py:44:identity_constraint" + }, + "properties": { + "confidence": "low", + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:44:identity_constraint", + "obligation_evidence": [], + "obligation_intent": null, + "obligation_kind": "protected_read", + "obligation_known_fix": null, + "obligation_label": "function_local", + "obligation_missing": "identity_constraint", + "obligation_provenance": null, + "obligation_resource": "users", + "ranking_priority": 0.3, + "reachability_conditions": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "verification": null + }, + "ruleId": "obligation" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 50 + } + } + } + ], + "message": { + "text": "protected_read on reports in report is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local." + }, + "partialFingerprints": { + "openultrasastFindingId": "obligation:protected_read:app.py:50:identity_constraint" + }, + "properties": { + "confidence": "low", + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:50:identity_constraint", + "obligation_evidence": [], + "obligation_intent": null, + "obligation_kind": "protected_read", + "obligation_known_fix": null, + "obligation_label": "function_local", + "obligation_missing": "identity_constraint", + "obligation_provenance": null, + "obligation_resource": "reports", + "ranking_priority": 0.3, + "reachability_conditions": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "verification": null + }, + "ruleId": "obligation" + }, + { + "level": "error", + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "app.py" + }, + "region": { + "startLine": 77 + } + } + } + ], + "message": { + "text": "protected_read on a resource in search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local." + }, + "partialFingerprints": { + "openultrasastFindingId": "obligation:protected_read:app.py:77:identity_constraint" + }, + "properties": { + "confidence": "low", + "evidence_level": "suspicion", + "finding_id": "obligation:protected_read:app.py:77:identity_constraint", + "obligation_evidence": [], + "obligation_intent": null, + "obligation_kind": "protected_read", + "obligation_known_fix": null, + "obligation_label": "function_local", + "obligation_missing": "identity_constraint", + "obligation_provenance": null, + "obligation_resource": null, + "ranking_priority": 0.3, + "reachability_conditions": [], + "reachability_status": "unknown", + "rung": "suspicion", + "severity": "high", + "verification": null + }, + "ruleId": "obligation" + } + ], + "tool": { + "driver": { + "informationUri": "https://github.com/norandom/OpenUltraSAST", + "name": "OpenUltraSAST", + "rules": [ + { + "id": "python-flask-debug", + "name": "Flask debug mode enabled needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "insecure_default", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Flask debug mode enabled needs review" + } + }, + { + "id": "python-os-command", + "name": "Python OS command execution needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Python OS command execution needs review" + } + }, + { + "id": "python-path-traversal", + "name": "Python file open with external input needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Python file open with external input needs review" + } + }, + { + "id": "python-shell-true", + "name": "Subprocess shell execution needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Subprocess shell execution needs review" + } + }, + { + "id": "python-sql-injection", + "name": "Python SQL string composition needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "injection", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Python SQL string composition needs review" + } + }, + { + "id": "python-ssrf", + "name": "Python outbound request with external input needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "network_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Python outbound request with external input needs review" + } + }, + { + "id": "python-ssti", + "name": "Python server-side template injection needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "injection", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Python server-side template injection needs review" + } + }, + { + "id": "python-unsafe-deserialization", + "name": "Unsafe Python deserialization needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Unsafe Python deserialization needs review" + } + }, + { + "id": "python-unsafe-eval", + "name": "Dynamic Python execution needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Dynamic Python execution needs review" + } + }, + { + "id": "python-weak-hash", + "name": "Python weak hash needs review", + "properties": { + "tags": [ + "crypto", + "deserialization", + "filesystem_entry", + "syscall_entry" + ] + }, + "shortDescription": { + "text": "Python weak hash needs review" + } + }, + { + "id": "overlay-coverage", + "name": "Overlay coverage: execute", + "properties": { + "tags": [ + "overlay-originated" + ] + }, + "shortDescription": { + "text": "Overlay coverage: execute" + } + }, + { + "id": "obligation", + "name": "Obligation not discharged: protected_read on users without identity_constraint", + "properties": { + "tags": [ + "obligation:protected_read", + "discharger:identity_constraint", + "obligation_evidence:function_local", + "resource:users" + ] + }, + "shortDescription": { + "text": "Obligation not discharged: protected_read on users without identity_constraint" + } + } + ] + } + } + } + ], + "version": "2.1.0" +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/stdout.txt b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/stdout.txt new file mode 100644 index 0000000..03f396b --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/stdout.txt @@ -0,0 +1,6 @@ +scan_id= +run_dir=/benchmarks/fixtures/python-vulnerable/.openultrasast/runs/ +file_targets=2 +ranked_targets=2 +findings=17 +calibrations_applied=1 diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/verification.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/verification.json new file mode 100644 index 0000000..e091501 --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/scan/verification.json @@ -0,0 +1,280 @@ +{ + "verifications": [ + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "No function-level attacker-reachable entry point currently reaches this line.", + "evidence_level": "static_corroboration", + "finding_id": "python-flask-debug:app.py:81", + "pro_case": "A static pattern matched the source line.", + "required_next_step": "Add reachability evidence before prioritizing a fix.", + "status": "rejected", + "tie_breaker": "Provide call-graph, route, CLI, parser, or dynamic evidence linking attacker input to this function.", + "verified": false + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-os-command:app.py:17", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-path-traversal:app.py:55", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-shell-true:app.py:23", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:44", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-sql-injection:app.py:50", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-ssrf:app.py:60", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-ssti:app.py:70", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:33", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-deserialization:app.py:38", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-unsafe-eval:app.py:28", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + }, + { + "context_sources": [ + "evidence_level", + "finding_id", + "function_name", + "line", + "path", + "reachability_conditions", + "reachability_evidence", + "reachability_status", + "severity", + "tags", + "title" + ], + "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", + "evidence_level": "static_corroboration", + "finding_id": "python-weak-hash:app.py:65", + "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", + "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", + "status": "accepted", + "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", + "verified": true + } + ] +} diff --git a/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/suite.json b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/suite.json new file mode 100644 index 0000000..b93ce54 --- /dev/null +++ b/benchmarks/measurements/2026-09-30-harnessx-removal-baseline/suite.json @@ -0,0 +1,1726 @@ +{ + "tests.test_benchmark::test_benchmark_attributes_per_rule_signals_and_recommendations": "passed", + "tests.test_benchmark::test_benchmark_cli_runs_scan_and_writes_scoreboard": "passed", + "tests.test_benchmark::test_benchmark_ingests_baselines_and_writes_calibration_records": "passed", + "tests.test_benchmark::test_benchmark_manifest_loads_expected_findings": "passed", + "tests.test_benchmark::test_benchmark_matching_uses_function_sink_and_evidence_text": "passed", + "tests.test_benchmark::test_benchmark_records_unmatched_findings_as_false_positives": "passed", + "tests.test_benchmark::test_benchmark_result_records_missed_expected_findings": "passed", + "tests.test_benchmark::test_repository_benchmark_manifests_load_and_point_to_fixtures": "passed", + "tests.test_calibration::test_false_positive_learning_records_reason_and_scope": "passed", + "tests.test_calibration::test_ranking_metrics_track_false_positive_reasons_by_tier": "passed", + "tests.test_calibration::test_scoped_false_positive_demotion_does_not_suppress_class_globally": "passed", + "tests.test_calibration::test_verified_outcome_does_not_create_false_positive_learning": "passed", + "tests.test_calibration::test_verifier_outcome_feeds_ranking_calibration_and_prompt_constraints": "passed", + "tests.test_candidate_enumeration::test_a_call_site_candidate_carries_what_the_model_needs_to_judge_it": "passed", + "tests.test_candidate_enumeration::test_a_labeled_function_with_nothing_to_judge_says_no_candidate": "passed", + "tests.test_candidate_enumeration::test_a_region_without_a_function_enumerates_the_whole_file": "passed", + "tests.test_candidate_enumeration::test_a_side_the_parser_rejects_yields_no_candidates_and_says_why": "passed", + "tests.test_candidate_enumeration::test_access_control_candidates_are_operations_with_the_guards_in_scope": "passed", + "tests.test_candidate_enumeration::test_enumerating_twice_returns_an_identical_sequence": "passed", + "tests.test_candidate_enumeration::test_every_family_shape_enumerates_something_on_a_file_that_has_it[config_secrets]": "passed", + "tests.test_candidate_enumeration::test_every_family_shape_enumerates_something_on_a_file_that_has_it[deserialization]": "passed", + "tests.test_candidate_enumeration::test_every_family_shape_enumerates_something_on_a_file_that_has_it[injection]": "passed", + "tests.test_candidate_enumeration::test_every_family_shape_enumerates_something_on_a_file_that_has_it[path]": "passed", + "tests.test_candidate_enumeration::test_every_family_shape_enumerates_something_on_a_file_that_has_it[untrusted_destination]": "passed", + "tests.test_candidate_enumeration::test_the_bound_is_a_constant_and_the_overflow_is_counted": "passed", + "tests.test_candidate_enumeration::test_the_ceiling_counts_labeled_functions_with_at_least_one_candidate": "passed", + "tests.test_candidate_enumeration::test_the_command_runs_offline_and_writes_a_stable_artifact": "passed", + "tests.test_candidate_enumeration::test_the_family_decides_which_kinds_are_candidates": "passed", + "tests.test_candidate_enumeration::test_the_ruleset_generator_is_measured_too_so_the_comparison_is_reproducible": "passed", + "tests.test_cli_hx_dispatch::test_degradation_recorded_when_models_set_but_extra_absent": "passed", + "tests.test_cli_hx_dispatch::test_manifest_has_no_harnessx_degradations_without_models": "passed", + "tests.test_cli_hx_dispatch::test_standard_scan_falls_back_to_run_hunter_pool": "passed", + "tests.test_cli_improve::test_improve_accepts_and_writes_loop_owned_ledger": "passed", + "tests.test_cli_improve::test_improve_dry_run_never_touches_the_targets_ledger": "passed", + "tests.test_cli_improve::test_improve_fails_loud_when_pair_catalog_is_missing": "passed", + "tests.test_cli_improve::test_improve_rejects_missing_manifest": "passed", + "tests.test_complexity_hints::test_attach_test_hints_leaves_scanned_tree_unchanged": "passed", + "tests.test_complexity_hints::test_covered_hotspot_emits_covered_and_no_test_kind": "passed", + "tests.test_complexity_hints::test_fuzzable_c_parser_without_harness_emits_fuzz_harness": "passed", + "tests.test_complexity_hints::test_no_adjacent_test_recommends_closed_test_kind": "passed", + "tests.test_complexity_hints::test_no_function_reference_when_adjacent_test_omits_function": "passed", + "tests.test_complexity_ledger::test_build_complexity_map_without_ledger_path_skips_overlay": "passed", + "tests.test_complexity_ledger::test_hotspot_key_joins_path_and_function_or_empty": "passed", + "tests.test_complexity_ledger::test_ledger_round_trip_matches_design_schema": "passed", + "tests.test_complexity_ledger::test_must_keep_as_candidate_requires_sev5_and_reachable_surface": "passed", + "tests.test_complexity_ledger::test_not_triggerable_overlay_drops_map_score_and_sev5_reachable_stays_candidate": "passed", + "tests.test_complexity_ledger::test_not_triggerable_overlay_drops_score_and_keeps_inventory_hit": "passed", + "tests.test_complexity_ledger::test_overlay_reorders_and_rebands_without_dropping_hits": "passed", + "tests.test_complexity_ledger::test_persist_verdicts_records_triggerable_and_skips_inconclusive": "passed", + "tests.test_complexity_ledger::test_select_forced_candidates_resolves_policy_severity": "passed", + "tests.test_complexity_ledger::test_triggerable_overlay_raises_later_score": "passed", + "tests.test_complexity_map::test_complexity_map_json_has_required_fields": "passed", + "tests.test_complexity_map::test_map_order_differs_from_inventory_hit_count": "passed", + "tests.test_complexity_signals::test_adjacent_test_from_repo_relative_paths": "passed", + "tests.test_complexity_signals::test_function_identity_uses_entry_point_names_or_stays_empty": "passed", + "tests.test_complexity_signals::test_inventory_density_is_recorded_but_cannot_dominate_score": "passed", + "tests.test_complexity_signals::test_nesting_from_source_text_otherwise_zero": "passed", + "tests.test_complexity_signals::test_nesting_reads_absolute_path_when_file_exists": "passed", + "tests.test_complexity_signals::test_parser_without_pattern_hit_outranks_one_line_helper_with_hit": "passed", + "tests.test_config::test_complexity_and_regress_defaults_when_section_absent": "passed", + "tests.test_config::test_embeddings_model_from_env": "passed", + "tests.test_config::test_fusion_defaults_when_section_absent": "passed", + "tests.test_config::test_hardening_defaults_when_section_absent": "passed", + "tests.test_config::test_harnessx_defaults_when_section_absent": "passed", + "tests.test_config::test_load_config_reads_fusion_section": "passed", + "tests.test_config::test_load_config_reads_hardening_section": "passed", + "tests.test_config::test_load_config_reads_harnessx_section": "passed", + "tests.test_config::test_load_config_reads_regress_image_pins": "passed", + "tests.test_config::test_load_config_reads_toml": "passed", + "tests.test_config::test_load_dotenv_sets_missing_keys_only": "passed", + "tests.test_config::test_override_changes_top_k_and_max_candidates_only": "passed", + "tests.test_config::test_write_resolved_config_creates_json": "passed", + "tests.test_cpg_backend::test_a_batch_goes_through_a_file_not_the_command_line": "passed", + "tests.test_cpg_backend::test_a_batch_is_one_invocation_carrying_many_requests": "passed", + "tests.test_cpg_backend::test_a_batch_no_part_can_answer_is_still_unavailable": "passed", + "tests.test_cpg_backend::test_a_batch_result_that_omits_a_request_returns_nothing_for_it": "passed", + "tests.test_cpg_backend::test_a_batch_that_fails_whole_is_answered_in_parts": "passed", + "tests.test_cpg_backend::test_a_build_is_refused_when_the_interpreter_cannot_read_the_tree": "passed", + "tests.test_cpg_backend::test_a_build_that_fails_on_both_launchers_leaves_no_scratch_behind": "passed", + "tests.test_cpg_backend::test_a_build_with_nothing_dropped_reports_no_unparsed_files": "passed", + "tests.test_cpg_backend::test_a_built_cpg_can_dispose_of_its_scratch_tree": "passed", + "tests.test_cpg_backend::test_a_built_cpg_offers_the_batch_path_to_its_driver": "passed", + "tests.test_cpg_backend::test_a_clean_build_whose_census_cannot_be_taken_is_a_failed_build": "passed", + "tests.test_cpg_backend::test_a_failed_batch_yields_no_rows_for_any_request": "passed", + "tests.test_cpg_backend::test_a_failed_joern_parse_retries_through_the_language_frontend": "passed", + "tests.test_cpg_backend::test_a_failing_or_slow_engine_fails_closed": "passed", + "tests.test_cpg_backend::test_a_file_php2cpg_miscompiles_is_excluded_and_named": "passed", + "tests.test_cpg_backend::test_a_file_the_frontend_dropped_is_carried_off_the_build": "passed", + "tests.test_cpg_backend::test_a_frontend_build_gets_its_overlays_once_at_build_time": "passed", + "tests.test_cpg_backend::test_a_joern_log_line_inside_the_fence_does_not_destroy_the_payload": "passed", + "tests.test_cpg_backend::test_a_killed_batch_retries_only_the_remainder": "passed", + "tests.test_cpg_backend::test_a_part_that_fails_leaves_only_its_own_requests_unanswered": "passed", + "tests.test_cpg_backend::test_a_php_build_that_never_stops_dropping_files_reports_them": "passed", + "tests.test_cpg_backend::test_a_readable_tree_builds_normally": "passed", + "tests.test_cpg_backend::test_a_scripted_backend_parses_a_query_result_without_joern": "passed", + "tests.test_cpg_backend::test_a_shard_that_cannot_answer_does_not_lose_the_others": "passed", + "tests.test_cpg_backend::test_a_silently_short_graph_is_reported_even_with_no_warnings": "passed", + "tests.test_cpg_backend::test_a_single_portion_kill_still_re_asks_its_remainder": "passed", + "tests.test_cpg_backend::test_a_source_file_the_size_of_a_data_table_is_excluded_and_named": "passed", + "tests.test_cpg_backend::test_a_streamed_payload_assembles_and_a_killed_one_keeps_what_finished": "passed", + "tests.test_cpg_backend::test_a_timed_out_query_kills_the_jvm_not_just_the_script": "passed", + "tests.test_cpg_backend::test_a_warning_about_a_file_the_graph_actually_holds_does_not_split_it": "passed", + "tests.test_cpg_backend::test_an_engine_failure_reports_the_line_that_names_the_cause": "passed", + "tests.test_cpg_backend::test_an_unknown_language_has_nothing_to_retry_with": "passed", + "tests.test_cpg_backend::test_files_the_frontend_refuses_get_a_cpg_of_their_own": "passed", + "tests.test_cpg_backend::test_heap_reaches_the_forked_script_jvm": "passed", + "tests.test_cpg_backend::test_javascript_partition_uses_declared_frontend_not_legacy_autodetection": "passed", + "tests.test_cpg_backend::test_joern_output_is_read_from_a_delimited_block_not_from_noisy_stdout": "passed", + "tests.test_cpg_backend::test_php_builds_through_the_frontend_and_retries_while_files_are_dropped": "passed", + "tests.test_cpg_backend::test_requests_held_for_arbitration_are_reported_as_unasked": "passed", + "tests.test_cpg_backend::test_rows_from_every_shard_reach_the_caller": "passed", + "tests.test_cpg_backend::test_shard_aggregation_does_not_invent_complete_named_census[answer]": "passed", + "tests.test_cpg_backend::test_shard_aggregation_does_not_invent_complete_named_census[census]": "passed", + "tests.test_cpg_backend::test_shard_aggregation_does_not_invent_complete_named_census[names]": "passed", + "tests.test_cpg_backend::test_shard_aggregation_preserves_complete_named_census[shard_names0]": "passed", + "tests.test_cpg_backend::test_shard_aggregation_preserves_complete_named_census[shard_names1]": "passed", + "tests.test_cpg_backend::test_streamed_costs_survive_every_layer": "passed", + "tests.test_cpg_backend::test_the_capability_probe_reuses_the_existing_joern_probe": "passed", + "tests.test_cpg_backend::test_the_census_checks_the_instrument": "passed", + "tests.test_cpg_backend::test_the_closure_exclusion_stops_at_the_release_that_fixed_it": "passed", + "tests.test_cpg_backend::test_the_engine_runs_under_a_bounded_heap": "passed", + "tests.test_cpg_backend::test_the_interpreter_must_read_the_frontend_parser_too": "passed", + "tests.test_cpg_backend::test_the_operator_can_raise_the_heap": "passed", + "tests.test_cpg_backend::test_the_portioner_asks_single_attempts_and_isolates_the_culprit": "passed", + "tests.test_cpg_backend::test_the_query_scripts_are_shipped_beside_the_seam": "passed", + "tests.test_cpg_backend::test_the_queue_re_asks_a_killed_remainder_and_terminates": "passed", + "tests.test_cpg_backend::test_the_seam_imports_nothing_outside_the_standard_library": "passed", + "tests.test_cpg_backend::test_the_sweep_removes_only_old_scratch_and_only_ours": "passed", + "tests.test_cpg_backend::test_without_joern_the_resolved_backend_is_the_null_one": "passed", + "tests.test_cpg_budget::test_budgeted_driver_does_not_retry_internal_typeerror": "passed", + "tests.test_cpg_budget::test_cancelled_graph_session_does_not_poison_next_build": "passed", + "tests.test_cpg_budget::test_cleanup_cannot_reset_expired_cancellation_allowance": "passed", + "tests.test_cpg_budget::test_cleanup_does_not_follow_substituted_directory_links": "passed", + "tests.test_cpg_budget::test_driver_cleans_graph_on_unexpected_exception": "passed", + "tests.test_cpg_budget::test_driver_propagates_budget_and_rejects_legacy_without_launch": "passed", + "tests.test_cpg_budget::test_early_process_timeout_stops_fallback_and_retries": "passed", + "tests.test_cpg_budget::test_expired_budget_launches_nothing": "passed", + "tests.test_cpg_budget::test_explicit_build_budget_is_retained_without_mutating_backend": "passed", + "tests.test_cpg_budget::test_failed_nonbatch_query_is_unjudged_on_budgeted_path": "passed", + "tests.test_cpg_budget::test_hanging_process_group_killed_inside_shared_allowance[False]": "passed", + "tests.test_cpg_budget::test_hanging_process_group_killed_inside_shared_allowance[True]": "passed", + "tests.test_cpg_budget::test_real_hanging_engine_stages_share_deadline_and_cleanup[census]": "passed", + "tests.test_cpg_budget::test_real_hanging_engine_stages_share_deadline_and_cleanup[frontend]": "passed", + "tests.test_cpg_budget::test_real_hanging_engine_stages_share_deadline_and_cleanup[overlay]": "passed", + "tests.test_cpg_budget::test_real_hanging_engine_stages_share_deadline_and_cleanup[probe]": "passed", + "tests.test_cpg_budget::test_real_hanging_engine_stages_share_deadline_and_cleanup[taint]": "passed", + "tests.test_cpg_budget::test_remaining_time_is_not_reset_between_commands": "passed", + "tests.test_cpg_budget::test_retry_timeout_consumes_same_absolute_budget": "passed", + "tests.test_cpg_budget::test_shard_failure_cannot_become_complete_empty_answer": "passed", + "tests.test_cpg_queries_compile::test_a_destination_whose_origin_is_fixed_is_not_untrusted": "skipped", + "tests.test_cpg_queries_compile::test_a_destructured_identity_discharges_what_it_reaches": "skipped", + "tests.test_cpg_queries_compile::test_a_field_the_method_just_overwrote_is_not_object_state": "skipped", + "tests.test_cpg_queries_compile::test_a_filter_returns_its_value_argument_not_its_context": "skipped", + "tests.test_cpg_queries_compile::test_a_literal_destination_is_not_an_untrusted_destination": "skipped", + "tests.test_cpg_queries_compile::test_a_path_through_a_query_result_or_a_whole_object_is_not_an_injection": "skipped", + "tests.test_cpg_queries_compile::test_a_qualified_setting_needs_its_receiver": "skipped", + "tests.test_cpg_queries_compile::test_a_redirect_validator_guards_only_where_it_held": "skipped", + "tests.test_cpg_queries_compile::test_a_response_body_write_is_an_output_encoding_sink": "skipped", + "tests.test_cpg_queries_compile::test_a_route_and_dao_split_raises_the_obligation_at_the_handler": "skipped", + "tests.test_cpg_queries_compile::test_a_sanitizer_the_value_passes_through_inside_an_expression_counts": "skipped", + "tests.test_cpg_queries_compile::test_a_sink_word_in_a_comment_is_not_a_sink": "skipped", + "tests.test_cpg_queries_compile::test_a_source_pattern_is_a_token_not_a_prefix": "skipped", + "tests.test_cpg_queries_compile::test_an_allowlist_check_guards_its_branch_and_its_ternary_arm": "skipped", + "tests.test_cpg_queries_compile::test_an_escaped_but_unquoted_field_is_object_state_that_carries_input": "skipped", + "tests.test_cpg_queries_compile::test_an_identity_constrained_handler_is_not_reported": "skipped", + "tests.test_cpg_queries_compile::test_an_sql_escape_protects_only_a_quoted_value": "skipped", + "tests.test_cpg_queries_compile::test_context_locations_outside_the_changed_files_are_summarised": "skipped", + "tests.test_cpg_queries_compile::test_each_query_compiles_and_answers[census]": "skipped", + "tests.test_cpg_queries_compile::test_each_query_compiles_and_answers[config]": "skipped", + "tests.test_cpg_queries_compile::test_each_query_compiles_and_answers[dominance]": "skipped", + "tests.test_cpg_queries_compile::test_each_query_compiles_and_answers[overlay]": "skipped", + "tests.test_cpg_queries_compile::test_each_query_compiles_and_answers[taint]": "skipped", + "tests.test_cpg_queries_compile::test_node_vm_is_an_eval_and_a_package_name_is_not_a_sink": "skipped", + "tests.test_cpg_queries_compile::test_only_a_collection_read_is_an_obligated_find": "skipped", + "tests.test_cpg_queries_compile::test_prototype_pollution_is_established_on_the_shape_it_declares": "skipped", + "tests.test_cpg_queries_compile::test_the_field_join_links_methods_only_through_the_object_itself": "skipped", + "tests.test_cpg_queries_compile::test_the_taint_query_streams_one_line_per_request": "skipped", + "tests.test_cpg_session::test_a_build_closes_the_session_it_started": "passed", + "tests.test_cpg_session::test_a_crashed_session_answers_nothing_afterwards": "passed", + "tests.test_cpg_session::test_a_definition_is_sent_unwrapped_and_is_not_proof_of_anything": "passed", + "tests.test_cpg_session::test_a_definition_on_a_dead_session_is_refused": "passed", + "tests.test_cpg_session::test_a_launch_failure_is_recorded_not_raised": "passed", + "tests.test_cpg_session::test_a_mismatched_receipt_poisons_the_session": "passed", + "tests.test_cpg_session::test_a_session_refuses_to_start_when_the_budget_cannot_afford_it": "passed", + "tests.test_cpg_session::test_a_session_that_cannot_start_falls_back_rather_than_answering": "passed", + "tests.test_cpg_session::test_a_started_session_answers_only_with_its_own_receipt": "passed", + "tests.test_cpg_session::test_a_startup_wait_is_bounded_by_its_allowance_not_the_deadline": "passed", + "tests.test_cpg_session::test_a_transport_failure_carries_the_server_log": "passed", + "tests.test_cpg_session::test_an_empty_body_is_an_answer_only_when_its_receipt_is_present": "passed", + "tests.test_cpg_session::test_an_exhausted_deadline_starts_nothing": "passed", + "tests.test_cpg_session::test_an_overlay_saved_under_the_session_workspace_is_found": "passed", + "tests.test_cpg_session::test_an_overlay_that_saves_no_graph_keeps_the_raw_one": "passed", + "tests.test_cpg_session::test_an_unsuccessful_response_is_not_an_answer": "passed", + "tests.test_cpg_session::test_cancellation_kills_the_process_group": "passed", + "tests.test_cpg_session::test_load_records_the_resident_graph_and_forgets_it_on_failure": "passed", + "tests.test_cpg_session::test_signal_module_is_used_for_group_termination": "passed", + "tests.test_cpg_session::test_the_backend_leaves_the_session_off_by_default": "passed", + "tests.test_cpg_session::test_the_driver_ends_the_session_with_the_transaction": "passed", + "tests.test_cpg_session::test_the_engine_body_is_retained_so_a_missing_receipt_can_be_explained": "passed", + "tests.test_cpg_session::test_the_session_switch_is_explicit_and_defaults_off": "passed", + "tests.test_cpg_session::test_the_wrapper_writes_its_receipt_before_running_the_body": "passed", + "tests.test_degradation_matrix::test_the_baseline_records_where_it_came_from": "passed", + "tests.test_degradation_matrix::test_the_three_gate_outputs_match_the_committed_pre_feature_baseline": "passed", + "tests.test_degradation_matrix::test_without_a_sandbox_the_regress_stage_is_skipped_by_name": "passed", + "tests.test_degradation_matrix::test_without_the_network_a_pointer_pair_is_skipped_by_name": "passed", + "tests.test_degradation_matrix::test_without_the_semantic_extra_an_unsupported_language_is_named_not_guessed": "passed", + "tests.test_detection_benchmarks::test_language_meets_recall_and_false_positive_goal[c_cpp]": "passed", + "tests.test_detection_benchmarks::test_language_meets_recall_and_false_positive_goal[java]": "passed", + "tests.test_detection_benchmarks::test_language_meets_recall_and_false_positive_goal[javascript]": "passed", + "tests.test_detection_benchmarks::test_language_meets_recall_and_false_positive_goal[python]": "passed", + "tests.test_detection_benchmarks::test_overall_detection_goal_is_met": "passed", + "tests.test_dispatch_value::test_a_dispatch_row_declares_returns_with_a_position": "passed", + "tests.test_dispatch_value::test_a_hook_callback_gets_the_registrys_arguments_not_the_requests": "passed", + "tests.test_dispatch_value::test_a_malformed_dispatch_row_is_refused[returns = [\"apply_filters\"]\\n]": "passed", + "tests.test_dispatch_value::test_a_malformed_dispatch_row_is_refused[returns = [\"not_an_apply_call\"]\\nvalue_arg = 2\\n]": "passed", + "tests.test_dispatch_value::test_a_malformed_dispatch_row_is_refused[value_arg = -1\\n]": "passed", + "tests.test_dispatch_value::test_every_callback_of_one_rest_registration_is_a_route": "passed", + "tests.test_dispatch_value::test_request_arguments_must_name_register_calls": "passed", + "tests.test_dispatch_value::test_the_shipped_facts_say_which_argument_a_filter_returns": "passed", + "tests.test_fact_memo::test_facts_are_parsed_once_and_reread_when_a_file_changes": "passed", + "tests.test_fact_memo::test_obligation_facts_are_parsed_once_and_reread_when_a_file_changes": "passed", + "tests.test_findings::test_findings_and_report_artifacts": "passed", + "tests.test_findings::test_findings_inherit_only_matching_function_level_reachability": "passed", + "tests.test_findings::test_quick_hunter_prompt_is_bounded": "passed", + "tests.test_findings::test_quick_scan_findings_emit_common_cpp_hazards": "passed", + "tests.test_findings::test_quick_scan_findings_emit_static_corroboration": "passed", + "tests.test_frontend_retention::test_build_config_retention_is_explicit_and_overrides_ambient_policy": "passed", + "tests.test_frontend_retention::test_builder_rejects_unrecognized_dependency_before_download": "passed", + "tests.test_frontend_retention::test_first_party_tests_enabled_by_backend": "passed", + "tests.test_frontend_retention::test_retention_can_be_disabled_explicitly": "passed", + "tests.test_fusion::test_accepted_when_reachable_and_verified": "passed", + "tests.test_fusion::test_blocked_when_reachable_high_severity_but_unverified": "passed", + "tests.test_fusion::test_decision_serializes_with_full_disclosure": "passed", + "tests.test_fusion::test_deferred_when_evidence_conflicts": "passed", + "tests.test_fusion::test_dispatch_only_fuses_triggered_findings": "passed", + "tests.test_fusion::test_dispatch_records_degradation_when_llm_requested_but_extra_absent": "passed", + "tests.test_fusion::test_evidence_conflict_triggers_when_rejected_but_reachable": "passed", + "tests.test_fusion::test_high_assurance_request_forces_a_trigger": "passed", + "tests.test_fusion::test_low_severity_unreachable_does_not_trigger": "passed", + "tests.test_fusion::test_mitigated_when_finding_is_known_mitigated": "passed", + "tests.test_fusion::test_quick_scan_does_not_emit_fusion": "passed", + "tests.test_fusion::test_rejected_when_verifier_rejects_unreachable": "passed", + "tests.test_fusion::test_standard_scan_emits_fusion_artifact_and_manifest_block": "passed", + "tests.test_fusion::test_triggers_on_high_severity_and_reachable": "passed", + "tests.test_fusion::test_verifier_disagreement_triggers": "passed", + "tests.test_gate::test_benchmark_output_is_byte_identical_to_golden_baseline": "passed", + "tests.test_gate::test_gate_fails_when_false_positive_rate_reaches_ceiling": "passed", + "tests.test_gate::test_gate_fails_when_recall_drops_below_floor": "passed", + "tests.test_gate::test_gate_passes_on_compliant_corpus": "passed", + "tests.test_gate::test_governance_scoring_benchmark_planes_never_import_harnessx": "passed", + "tests.test_gate::test_harnessx_stage_stays_within_tolerance_of_baseline": "skipped", + "tests.test_gate::test_live_corpus_clears_the_gate": "passed", + "tests.test_gate::test_passing_detection_with_blocking_score_failure_blocks": "passed", + "tests.test_gate::test_planes_have_no_module_level_harnessx_import": "passed", + "tests.test_gate::test_score_improvement_cannot_unblock_a_gate_breaching_change": "passed", + "tests.test_gate::test_within_tolerance_band_logic": "passed", + "tests.test_gitignore_semantics::test_a_tracked_file_is_never_ignored": "passed", + "tests.test_gitignore_semantics::test_an_export_keeps_what_the_ignore_file_re_includes": "passed", + "tests.test_gitignore_semantics::test_ignore_rules_agree_with_git": "passed", + "tests.test_graph_reuse::test_corruption_partial_census_and_deadline_are_misses": "passed", + "tests.test_graph_reuse::test_generic_driver_accepts_backend_validated_lease": "passed", + "tests.test_graph_reuse::test_graph_identity_rejects_unreadable_or_symlink_sources": "passed", + "tests.test_graph_reuse::test_identity_reads_content_and_rejects_changed_inputs": "passed", + "tests.test_graph_reuse::test_installed_frontend_adaptation_changes_graph_identity": "passed", + "tests.test_graph_reuse::test_lease_isolates_loads_and_cleanup_preserves_original": "passed", + "tests.test_hardening_pipeline::test_max_findings_budget_truncates_and_records_degradation": "passed", + "tests.test_hardening_pipeline::test_redaction_can_be_disabled": "passed", + "tests.test_hardening_pipeline::test_trace_does_not_leak_secrets_by_default": "passed", + "tests.test_harness::test_harness_config_serializes_models_processors_and_prompt_hashes": "passed", + "tests.test_harness::test_runtime_emits_stage_events_and_processor_state": "passed", + "tests.test_harness::test_strict_contract_mode_rejects_undeclared_writes": "passed", + "tests.test_harness::test_warn_contract_mode_records_degradation": "passed", + "tests.test_harness_ext::test_build_provider_constructs_selected_provider[anthropic-AnthropicProvider]": "skipped", + "tests.test_harness_ext::test_build_provider_constructs_selected_provider[openai-OpenAIProvider]": "skipped", + "tests.test_harness_ext::test_build_provider_rejects_unknown_provider_before_importing": "passed", + "tests.test_harness_ext::test_core_dependencies_are_pyyaml_only": "passed", + "tests.test_harness_ext::test_harnessx_is_a_sha_pinned_optional_extra": "passed", + "tests.test_harness_ext::test_has_harnessx_probes_without_importing": "passed", + "tests.test_harness_ext::test_importing_openultrasast_does_not_import_harnessx": "passed", + "tests.test_harness_ext::test_require_harnessx_raises_with_install_guidance_when_absent": "passed", + "tests.test_harness_ext::test_supported_providers_cover_anthropic_and_openai": "passed", + "tests.test_harnessx_removal_equality::test_a_changed_finding_is_reported_with_its_key": "passed", + "tests.test_harnessx_removal_equality::test_a_changed_outcome_or_unmapped_test_is_reported": "passed", + "tests.test_harnessx_removal_equality::test_a_file_present_on_one_side_only_is_reported": "passed", + "tests.test_harnessx_removal_equality::test_excluded_fields_and_run_ids_do_not_count": "passed", + "tests.test_hunter::test_assign_tier_uses_priority_bands": "passed", + "tests.test_hunter::test_run_hunter_pool_persists_trajectory_linked_to_finding": "passed", + "tests.test_hunter::test_schedule_hunter_tasks_assigns_budget_and_skill_metadata": "passed", + "tests.test_hunter::test_select_skill_snippets_routes_crypto_and_auth_targets": "passed", + "tests.test_hunter::test_standard_mode_writes_hunter_trajectory_and_manifest_ref": "passed", + "tests.test_hunter_curated_tools::test_a_hunt_that_never_called_a_tool_still_reports_nothing": "passed", + "tests.test_hunter_curated_tools::test_entry_points_lists_handlers_with_their_access_and_never_source_text": "passed", + "tests.test_hunter_curated_tools::test_flows_lists_adjudicated_source_to_sink_records_for_one_function": "passed", + "tests.test_hunter_curated_tools::test_obligations_lists_what_a_function_owes_without_dumping_code": "passed", + "tests.test_hunter_curated_tools::test_read_definition_returns_one_span_and_refuses_to_leave_the_repository": "passed", + "tests.test_hunter_curated_tools::test_the_loop_asks_once_more_for_the_answer_instead_of_dropping_prose": "passed", + "tests.test_hunter_curated_tools::test_the_loop_keeps_todays_behaviour_by_default": "passed", + "tests.test_hunter_curated_tools::test_the_loop_takes_a_prompt_context_tools_and_tags_and_replays_reasoning": "passed", + "tests.test_hunter_harness::test_build_sast_raises_without_extra": "passed", + "tests.test_hunter_harness::test_build_sast_returns_harness_config_offline": "skipped", + "tests.test_hunter_harness::test_extract_findings_parses_json_array_and_tolerates_garbage": "passed", + "tests.test_hunter_harness::test_module_import_does_not_pull_harnessx": "passed", + "tests.test_hunter_harness::test_orchestrator_builds_agent_offline": "skipped", + "tests.test_hunter_harness::test_orchestrator_construction_raises_without_extra": "passed", + "tests.test_hunter_tools::test_a_match_in_a_minified_line_is_quoted_not_returned_whole": "passed", + "tests.test_hunter_tools::test_clamp_repo_path_rejects_dotdot_and_absolute_escapes": "passed", + "tests.test_hunter_tools::test_find_refs_rejects_mapping_path_escape": "passed", + "tests.test_hunter_tools::test_find_refs_uses_mapping_index_and_clamped_text_search": "passed", + "tests.test_hunter_tools::test_grep_reads_the_tree_once_and_sees_an_edit": "passed", + "tests.test_hunter_tools::test_grep_repo_does_not_search_outside_root": "passed", + "tests.test_hunter_tools::test_grep_repo_honors_max_matches": "passed", + "tests.test_hunter_tools::test_read_file_truncates_and_rejects_symlink_escape": "passed", + "tests.test_hunter_tools::test_read_grep_and_reject_path_escape": "passed", + "tests.test_improve::test_build_rule_signals_separates_miss_and_fp": "passed", + "tests.test_improve::test_profile_gate_ignores_title_and_advisory_tiers": "passed", + "tests.test_improve::test_profile_gate_scores_vendored_pairs_only": "passed", + "tests.test_improve::test_propose_status_edits_auto_shadows_precision_draggers_only": "passed", + "tests.test_improve::test_round_accepts_when_profiles_hold_and_reports_small_profiles": "passed", + "tests.test_improve::test_round_auto_shadows_noisy_rule_and_accepts": "passed", + "tests.test_improve::test_round_rejects_when_a_profile_regresses_on_holdout": "passed", + "tests.test_improve::test_round_reverts_byte_for_byte_when_shadowing_would_drop_recall": "passed", + "tests.test_improve::test_run_improvement_converges_after_accepting": "passed", + "tests.test_improve::test_validator_accepts_enabled_to_shadow": "passed", + "tests.test_improve::test_validator_never_tunes_severity_and_bounds_constants": "passed", + "tests.test_improve::test_validator_rejects_enabled_to_disabled_jump": "passed", + "tests.test_improve::test_validator_rejects_unknown_rule_and_bad_status": "passed", + "tests.test_independent_population::test_a_multi_language_repository_is_reserved[population-v1]": "passed", + "tests.test_independent_population::test_a_multi_language_repository_is_reserved[population-v2]": "passed", + "tests.test_independent_population::test_no_reserved_repository_is_referenced_by_the_development_tree": "passed", + "tests.test_independent_population::test_the_reservation_is_well_formed[population-v1]": "passed", + "tests.test_independent_population::test_the_reservation_is_well_formed[population-v2]": "passed", + "tests.test_index::test_build_code_chunks_preserves_metadata_filters": "passed", + "tests.test_index::test_json_vector_index_round_trips_and_filters": "passed", + "tests.test_index::test_namespace_chunks_and_reuse_key_are_metadata_scoped": "passed", + "tests.test_index::test_retrieval_package_is_bounded_by_character_budget": "passed", + "tests.test_index::test_vector_index_rejects_embedding_count_mismatch": "passed", + "tests.test_layout_facts::test_a_layout_row_without_an_id_is_refused": "passed", + "tests.test_layout_facts::test_layout_rows_load_and_match": "passed", + "tests.test_layout_facts::test_test_regions_are_not_product_and_order_last": "passed", + "tests.test_layout_facts::test_the_scan_excludes_vendored_trees_before_the_build": "passed", + "tests.test_layout_facts::test_vendored_directories_are_named_shallowest_first": "passed", + "tests.test_layout_facts::test_vendored_trees_leave_the_targets": "passed", + "tests.test_map_gate::test_hit_count_stub_fails_map_gate_on_split_sink_python": "passed", + "tests.test_map_gate::test_map_beats_hit_count_rejects_inventory_sorted_stub": "passed", + "tests.test_map_gate::test_planted_split_sink_function_is_in_high_band": "passed", + "tests.test_map_gate::test_split_sink_gate_corpus_is_not_the_stage1_smoke_gate": "passed", + "tests.test_map_gate::test_split_sink_map_gate_passes_heuristic_map": "passed", + "tests.test_mapping::test_a_php_method_with_a_visibility_modifier_is_a_region": "passed", + "tests.test_mapping::test_an_array_callable_is_a_handler_too": "passed", + "tests.test_mapping::test_entry_point_mapping_classifies_routes_and_attaches_reachability": "passed", + "tests.test_mapping::test_entry_point_mapping_covers_solidity_state_changing_access": "passed", + "tests.test_mapping::test_entry_point_mapping_distinguishes_authenticated_routes_and_conditions": "passed", + "tests.test_mapping::test_entry_point_mapping_records_solidity_feature_conditions": "passed", + "tests.test_mapping::test_entry_points_name_handlers_registered_by_call_or_convention": "passed", + "tests.test_mapping::test_every_php_function_becomes_a_region": "passed", + "tests.test_mapping::test_ingest_sarif_normalizes_semgrep_hints": "passed", + "tests.test_mapping::test_mapping_task_records_cover_disciplines": "passed", + "tests.test_mapping::test_static_hints_attach_to_file_targets_and_evidence_candidates": "passed", + "tests.test_mapping::test_wordpress_hooks_declare_their_access": "passed", + "tests.test_mapping::test_write_entry_points_artifact": "passed", + "tests.test_mapping::test_write_static_hints_artifact": "passed", + "tests.test_mcp::test_export_report_returns_markdown": "passed", + "tests.test_mcp::test_initialize_returns_server_info": "passed", + "tests.test_mcp::test_missing_required_argument_is_a_tool_error": "passed", + "tests.test_mcp::test_notifications_get_no_response": "passed", + "tests.test_mcp::test_propose_patch_degrades_visibly": "passed", + "tests.test_mcp::test_scan_rejects_deep_and_keeps_cli_only_modes": "passed", + "tests.test_mcp::test_scan_then_status_and_findings": "passed", + "tests.test_mcp::test_serve_stdio_loop_handles_tools_list": "passed", + "tests.test_mcp::test_surface_exposes_no_shell_or_exec_tool": "passed", + "tests.test_mcp::test_the_findings_list_carries_the_rung_and_leads_with_what_was_decided": "passed", + "tests.test_mcp::test_tools_list_is_exactly_the_narrow_surface": "passed", + "tests.test_mcp::test_unknown_method_returns_jsonrpc_error": "passed", + "tests.test_model_calibrate::test_a_cve_recipe_yields_the_parent_and_fix_commits": "passed", + "tests.test_model_calibrate::test_a_pair_the_model_cannot_split_is_a_named_gap_not_a_miss": "passed", + "tests.test_model_calibrate::test_a_pair_the_model_splits_is_covered": "passed", + "tests.test_model_calibrate::test_flagging_both_sides_equally_is_a_gap_not_a_success": "passed", + "tests.test_model_calibrate::test_gaps_are_grouped_by_family_with_their_reasons": "passed", + "tests.test_model_calibrate::test_the_report_is_per_slice_and_names_the_deciding_one": "passed", + "tests.test_model_calibrate::test_the_report_refuses_a_bare_aggregate": "passed", + "tests.test_model_change_context::test_a_declared_exclusion_beside_an_integrity_failure_still_demotes": "passed", + "tests.test_model_change_context::test_a_declared_vendor_exclusion_does_not_invalidate_a_first_party_answer": "passed", + "tests.test_model_change_context::test_a_family_whose_context_query_answers_nothing_stays_unresolved": "passed", + "tests.test_model_change_context::test_a_gap_in_another_partition_does_not_demote_this_one": "passed", + "tests.test_model_change_context::test_a_question_naming_a_function_the_file_does_not_define_says_so": "passed", + "tests.test_model_change_context::test_a_second_language_does_not_invalidate_the_first_language_answer": "passed", + "tests.test_model_change_context::test_a_skipped_symlink_is_owned_by_its_own_path": "passed", + "tests.test_model_change_context::test_an_unresolved_context_projection_still_demotes_the_question": "passed", + "tests.test_model_change_context::test_any_other_inherited_transaction_gap_still_marks_questions_incomplete": "passed", + "tests.test_model_change_context::test_attaching_relationships_is_linear_in_what_it_attaches": "passed", + "tests.test_model_change_context::test_bounded_reachability_is_recorded_without_demoting_an_answered_question": "passed", + "tests.test_model_change_context::test_change_does_not_replace_ranker_selection": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[callee-javascript-js]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[callee-php-php]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[entry-javascript-js]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[entry-php-php]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[field-javascript-js]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[field-php-php]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[guard-javascript-js]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[guard-php-php]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[hook-javascript-js]": "passed", + "tests.test_model_change_context::test_changed_dependency_reaches_unchanged_ranked_question[hook-php-php]": "passed", + "tests.test_model_change_context::test_context_expansion_uses_transaction_deadline": "passed", + "tests.test_model_change_context::test_correspondence_ambiguity_alone_does_not_make_every_question_incomplete": "passed", + "tests.test_model_change_context::test_dominance_and_config_questions_get_their_own_change_context": "passed", + "tests.test_model_change_context::test_empty_method_projection_is_not_complete_negative": "passed", + "tests.test_model_change_context::test_failed_build_retains_comparison_and_boundary": "passed", + "tests.test_model_change_context::test_full_paths_do_not_merge_duplicate_basenames": "passed", + "tests.test_model_change_context::test_global_boundary_survives_answer": "passed", + "tests.test_model_change_context::test_indexed_matching_attaches_exactly_what_the_row_by_row_matching_did": "passed", + "tests.test_model_change_context::test_missing_base_without_adapter_diagnostic_stays_incomplete": "passed", + "tests.test_model_change_context::test_missing_or_external_source_cannot_manufacture_relationship[../external.php]": "passed", + "tests.test_model_change_context::test_missing_or_external_source_cannot_manufacture_relationship[/outside/missing.php]": "passed", + "tests.test_model_change_context::test_missing_or_external_source_cannot_manufacture_relationship[missing.php]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[False-missing-file]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[False-no-extent]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[False-outside-root]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[False-valid]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[True-missing-file]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[True-no-extent]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[True-outside-root]": "passed", + "tests.test_model_change_context::test_summarised_locations_decide_exactly_what_itemised_ones_did[True-valid]": "passed", + "tests.test_model_change_context::test_the_evidence_pass_names_the_changed_files_to_the_engine": "passed", + "tests.test_model_change_context::test_unavailable_relationships_cannot_be_completed_negative": "passed", + "tests.test_model_change_context::test_unexported_configuration_and_deleted_dependencies_are_explicit[declaration_paths]": "passed", + "tests.test_model_change_context::test_unexported_configuration_and_deleted_dependencies_are_explicit[deleted_paths]": "passed", + "tests.test_model_config_value::test_a_failed_query_is_not_read_as_a_safe_configuration": "passed", + "tests.test_model_config_value::test_a_file_reports_every_permissive_setting_not_the_first": "passed", + "tests.test_model_config_value::test_a_non_literal_argument_is_corroborated_not_entailed": "passed", + "tests.test_model_config_value::test_a_permissive_literal_is_entailed": "passed", + "tests.test_model_config_value::test_a_restrictive_literal_yields_no_finding": "passed", + "tests.test_model_config_value::test_a_setting_that_is_not_in_the_spec_is_ignored": "passed", + "tests.test_model_config_value::test_a_setting_whose_polarity_is_unchanged_still_reports_true": "passed", + "tests.test_model_config_value::test_a_strong_algorithm_yields_no_finding": "passed", + "tests.test_model_config_value::test_a_weak_algorithm_is_entailed_by_its_literal": "passed", + "tests.test_model_config_value::test_disabling_template_escaping_is_entailed": "passed", + "tests.test_model_config_value::test_enabling_template_escaping_is_not_a_finding": "passed", + "tests.test_model_config_value::test_one_setting_with_two_permissive_literals_is_one_finding": "passed", + "tests.test_model_config_value::test_the_first_setting_in_a_file_is_the_one_reported": "passed", + "tests.test_model_config_value::test_the_settings_table_covers_the_frameworks_in_the_corpus": "passed", + "tests.test_model_config_value::test_the_verdict_is_deterministic": "passed", + "tests.test_model_dominance::test_a_failed_query_is_not_read_as_an_absence_of_operations": "passed", + "tests.test_model_dominance::test_a_guarded_operation_yields_no_finding": "passed", + "tests.test_model_dominance::test_a_method_with_two_operations_counts_once_as_a_sibling": "passed", + "tests.test_model_dominance::test_a_verdict_without_a_reported_file_carries_no_location": "passed", + "tests.test_model_dominance::test_an_access_control_finding_names_a_line_a_contributor_can_open": "passed", + "tests.test_model_dominance::test_an_unguarded_operation_among_guarded_siblings_is_entailed": "passed", + "tests.test_model_dominance::test_an_unguarded_operation_with_no_guarded_sibling_is_only_corroborated": "passed", + "tests.test_model_dominance::test_no_obligated_operation_yields_no_verdict": "passed", + "tests.test_model_dominance::test_the_spec_drives_the_query_parameters": "passed", + "tests.test_model_dominance::test_the_verdict_is_deterministic_over_one_cpg": "passed", + "tests.test_model_endpoint::test_a_provider_that_refuses_to_build_degrades_to_no_endpoint": "passed", + "tests.test_model_endpoint::test_a_reply_without_logprobs_reports_none_rather_than_a_number": "passed", + "tests.test_model_endpoint::test_cost_comes_from_the_providers_own_usage_fields": "passed", + "tests.test_model_endpoint::test_deepseek_wins_over_openrouter_and_never_touches_the_embedding_endpoint": "passed", + "tests.test_model_endpoint::test_log_probabilities_are_requested_only_when_asked_for": "passed", + "tests.test_model_endpoint::test_logprobs_are_read_off_the_choice_where_the_provider_puts_them": "passed", + "tests.test_model_endpoint::test_resolution_order_override_then_scripted_then_openrouter_then_none": "passed", + "tests.test_model_endpoint::test_the_adapter_disables_thinking_asks_for_json_and_keeps_the_reasoning_field": "passed", + "tests.test_model_endpoint::test_the_adapter_retries_once_on_empty_json_content_then_gives_up": "passed", + "tests.test_model_endpoint::test_the_config_can_point_the_chat_endpoint_somewhere_else": "passed", + "tests.test_model_endpoint::test_the_config_can_turn_thinking_on": "passed", + "tests.test_model_endpoint::test_the_default_model_is_an_api_name_the_platform_lists": "passed", + "tests.test_model_endpoint::test_the_hunter_reaches_deepseek_when_its_key_is_set": "passed", + "tests.test_model_endpoint::test_the_underlying_client_forwards_extra_body_and_keeps_usage": "passed", + "tests.test_model_endpoint::test_thinking_is_a_measured_condition_on_the_models_section": "passed", + "tests.test_model_evidence::test_a_bound_shape_is_the_arbiters_own_rule": "passed", + "tests.test_model_evidence::test_a_carried_field_counts_as_a_source": "passed", + "tests.test_model_evidence::test_a_failed_query_is_not_a_tier": "passed", + "tests.test_model_evidence::test_a_literal_argument_cannot_carry_taint": "passed", + "tests.test_model_evidence::test_a_sink_with_no_source_is_asked_last": "passed", + "tests.test_model_evidence::test_a_stringified_boolean_is_read_as_its_value_not_its_truthiness": "passed", + "tests.test_model_evidence::test_an_unshipped_file_orders_after_a_shipped_one_in_the_same_tier": "passed", + "tests.test_model_evidence::test_carried_provenance_promotes_only_when_source_fed": "passed", + "tests.test_model_evidence::test_cleansing_on_the_call_itself_lowers_the_tier": "passed", + "tests.test_model_evidence::test_declared_public_or_a_local_source_asks_very_first": "passed", + "tests.test_model_evidence::test_no_sink_anywhere_in_the_repository_is_tier_zero_at_any_depth": "passed", + "tests.test_model_evidence::test_no_sink_in_scope_is_tier_zero_and_exact": "passed", + "tests.test_model_evidence::test_the_cve_shape_is_the_top_tier": "passed", + "tests.test_model_evidence::test_the_query_may_answer_carried_itself": "passed", + "tests.test_model_evidence::test_the_score_orders_within_a_tier_and_never_across_one": "passed", + "tests.test_model_execution::test_a_candidate_that_does_not_reproduce_stays_where_it_was": "passed", + "tests.test_model_execution::test_a_finding_the_model_already_decided_is_not_escalated": "passed", + "tests.test_model_execution::test_a_reproduced_candidate_reaches_execution_confirmed": "passed", + "tests.test_model_execution::test_an_ineligible_finding_is_not_sent_to_the_sandbox_even_when_one_exists": "passed", + "tests.test_model_execution::test_only_a_family_a_static_model_cannot_arbitrate_is_eligible": "passed", + "tests.test_model_execution::test_the_seam_reimplements_no_sandbox_machinery": "passed", + "tests.test_model_execution::test_without_clearwing_the_rung_is_never_reached_and_the_reason_is_recorded": "passed", + "tests.test_model_judge::test_a_claim_the_model_contradicts_is_dropped_with_its_reason": "passed", + "tests.test_model_judge::test_a_claim_the_model_supports_advances_to_corroborated": "passed", + "tests.test_model_judge::test_an_entailed_candidate_costs_no_model_call": "passed", + "tests.test_model_judge::test_the_llm_declining_leaves_a_corroborated_flow_at_suspicion": "passed", + "tests.test_model_judge::test_the_prompt_is_redacted": "passed", + "tests.test_model_judge::test_the_question_is_bounded_typed_and_offers_no_tools": "passed", + "tests.test_model_judge::test_there_is_no_k_run_averaging_anywhere_in_the_judge": "passed", + "tests.test_model_judge::test_without_a_client_the_verdict_still_stands_on_its_own": "passed", + "tests.test_model_ladder::test_a_finding_defaults_to_suspicion": "passed", + "tests.test_model_ladder::test_a_none_verdict_leaves_the_finding_at_suspicion": "passed", + "tests.test_model_ladder::test_every_rung_round_trips_through_json": "passed", + "tests.test_model_ladder::test_only_a_verdict_raises_a_finding_above_suspicion": "passed", + "tests.test_model_ladder::test_the_legacy_evidence_level_is_left_alone": "passed", + "tests.test_model_ladder::test_the_rung_reaches_markdown_json_and_sarif": "passed", + "tests.test_model_ladder::test_the_rungs_are_ordered_and_comparable": "passed", + "tests.test_model_partitions::test_declared_javascript_tests_remain_inputs_but_unshipped": "passed", + "tests.test_model_partitions::test_evidence_ranker_selects_once_across_languages": "passed", + "tests.test_model_partitions::test_file_patterns_symlinks_and_witness_paths": "passed", + "tests.test_model_partitions::test_named_census_accepts_exact_paths_for_every_query_kind": "passed", + "tests.test_model_partitions::test_partial_partition_census_never_completes_questions[None]": "passed", + "tests.test_model_partitions::test_partial_partition_census_never_completes_questions[census0]": "passed", + "tests.test_model_partitions::test_partial_partition_census_never_completes_questions[census1]": "passed", + "tests.test_model_partitions::test_partial_partition_census_never_completes_questions[census2]": "passed", + "tests.test_model_partitions::test_partition_records_reach_cli": "passed", + "tests.test_model_partitions::test_polyglot_graph_inputs_and_single_scope": "passed", + "tests.test_model_partitions::test_projection_refuses_substituted_ancestor": "passed", + "tests.test_model_partitions::test_shared_deadline_stops_later_frontend_and_no_false_clean": "passed", + "tests.test_model_partitions::test_stale_region_cannot_bypass_vendor_graph_exclusion": "passed", + "tests.test_model_partitions::test_synthetic_census_node_cannot_mask_missing_source": "passed", + "tests.test_model_partitions::test_unnamed_sharded_census_remains_explicitly_incomplete": "passed", + "tests.test_model_partitions::test_unreadable_unknown_extension_reports_incomplete_without_crashing": "passed", + "tests.test_model_partitions::test_unsupported_only_population_is_named": "passed", + "tests.test_model_pipeline::test_a_candidate_the_judge_declines_is_not_reported": "passed", + "tests.test_model_pipeline::test_a_candidate_the_model_cannot_see_is_reported_at_suspicion": "passed", + "tests.test_model_pipeline::test_a_configuration_family_is_arbitrated_by_constant_abstraction": "passed", + "tests.test_model_pipeline::test_a_corroborated_absence_finding_survives_a_judge_that_agrees": "passed", + "tests.test_model_pipeline::test_a_sanitized_flow_the_judge_confirms_becomes_corroborated": "passed", + "tests.test_model_pipeline::test_a_sanitized_flow_the_judge_rejects_yields_nothing": "passed", + "tests.test_model_pipeline::test_a_witness_line_is_read_whatever_follows_the_number": "passed", + "tests.test_model_pipeline::test_an_absence_family_is_arbitrated_by_dominance_not_taint": "passed", + "tests.test_model_pipeline::test_an_arbiter_that_knows_where_the_evidence_is_names_that_file": "passed", + "tests.test_model_pipeline::test_an_arbitrated_finding_names_its_file_the_way_a_candidate_does": "passed", + "tests.test_model_pipeline::test_an_entailed_site_becomes_a_finding_with_no_model_call": "passed", + "tests.test_model_pipeline::test_the_candidate_budget_is_bounded": "passed", + "tests.test_model_pipeline::test_the_dominance_question_describes_the_evidence_the_model_actually_has": "passed", + "tests.test_model_pipeline::test_the_residual_question_matches_the_arbiter_that_raised_it": "passed", + "tests.test_model_pipeline::test_without_a_client_only_what_the_model_establishes_is_reported": "passed", + "tests.test_model_regions::test_a_declared_open_endpoint_carries_no_authorization_obligation": "passed", + "tests.test_model_regions::test_a_file_level_region_is_not_given_a_second_module_region": "passed", + "tests.test_model_regions::test_a_file_with_an_entry_point_is_not_also_a_fallback_region": "passed", + "tests.test_model_regions::test_a_file_with_no_entry_point_still_gets_a_region_that_says_so": "passed", + "tests.test_model_regions::test_a_file_with_only_nameless_entry_points_still_gets_one_region": "passed", + "tests.test_model_regions::test_a_function_scoped_file_still_gets_its_module_body_asked_about": "passed", + "tests.test_model_regions::test_a_module_body_is_not_offered_the_handler_families": "passed", + "tests.test_model_regions::test_a_project_that_declares_nothing_is_not_penalised": "passed", + "tests.test_model_regions::test_a_route_registered_but_not_defined_here_is_scoped_to_its_file": "passed", + "tests.test_model_regions::test_an_absence_family_is_only_offered_where_there_is_a_handler": "passed", + "tests.test_model_regions::test_an_entry_point_becomes_a_region": "passed", + "tests.test_model_regions::test_an_inferred_public_endpoint_keeps_the_obligation": "passed", + "tests.test_model_regions::test_an_unsupported_language_yields_no_region": "passed", + "tests.test_model_regions::test_nameless_entry_points_do_not_duplicate_a_file_already_covered": "passed", + "tests.test_model_regions::test_public_entry_points_outrank_internal_ones": "passed", + "tests.test_model_regions::test_regions_carry_only_families_their_language_has_specs_for": "passed", + "tests.test_model_regions::test_the_main_guard_marker_is_translated_to_module_scope": "passed", + "tests.test_model_regions::test_the_order_is_total_so_two_runs_agree": "passed", + "tests.test_model_regions::test_two_named_handlers_in_one_file_are_two_regions": "passed", + "tests.test_model_regions::test_what_the_project_does_not_ship_ranks_below_what_it_does": "passed", + "tests.test_model_report::test_a_bare_aggregate_is_refused": "passed", + "tests.test_model_report::test_every_finding_shows_its_rung": "passed", + "tests.test_model_report::test_the_deciding_slice_is_named_in_the_report": "passed", + "tests.test_model_report::test_the_gap_is_absent_rather_than_zero_when_a_slice_is_missing": "passed", + "tests.test_model_report::test_the_overfitting_gap_is_published_beside_the_headline": "passed", + "tests.test_model_report::test_the_report_carries_a_row_per_slice": "passed", + "tests.test_model_scan::test_a_failed_build_still_reports_what_the_build_cost": "passed", + "tests.test_model_scan::test_a_failed_build_yields_an_empty_result_not_an_exception": "passed", + "tests.test_model_scan::test_a_query_the_engine_could_not_answer_is_recorded_not_ignored": "passed", + "tests.test_model_scan::test_a_region_cap_that_hides_most_of_a_repository_is_reported": "passed", + "tests.test_model_scan::test_a_region_is_only_asked_about_families_it_carries": "passed", + "tests.test_model_scan::test_a_region_the_budget_could_not_afford_is_not_reported_as_clean": "passed", + "tests.test_model_scan::test_an_exhausted_budget_withholds_the_judge_and_not_the_graph": "passed", + "tests.test_model_scan::test_findings_are_ordered_by_rung_before_rank": "passed", + "tests.test_model_scan::test_one_cpg_is_built_for_the_whole_repository": "passed", + "tests.test_model_scan::test_one_defect_is_one_finding_however_many_regions_reach_it": "passed", + "tests.test_model_scan::test_only_an_entry_point_gets_the_interprocedural_question": "passed", + "tests.test_model_scan::test_the_budget_is_spent_by_evidence_when_asked": "passed", + "tests.test_model_scan::test_the_budget_is_spent_on_the_highest_ranked_regions_first": "passed", + "tests.test_model_scan::test_the_call_depth_is_bounded": "passed", + "tests.test_model_scan::test_the_driver_issues_one_query_invocation_per_kind_not_one_per_region": "passed", + "tests.test_model_scan::test_the_result_reports_what_the_model_arbitrated": "passed", + "tests.test_model_scan::test_the_scan_reports_query_time_per_kind": "passed", + "tests.test_model_scan::test_the_scan_reports_where_its_wall_clock_went": "passed", + "tests.test_model_scan::test_tier_zero_pairs_are_not_asked_and_nothing_else_is_skipped": "passed", + "tests.test_model_scan::test_two_families_at_one_site_stay_two_findings": "passed", + "tests.test_model_scan_stage::test_a_disabled_model_layer_runs_nothing": "passed", + "tests.test_model_scan_stage::test_the_config_is_readable_from_toml": "passed", + "tests.test_model_scan_stage::test_the_model_config_block_exists_and_is_conservative": "passed", + "tests.test_model_scan_stage::test_the_payload_reports_what_the_model_arbitrated": "passed", + "tests.test_model_scan_stage::test_unjudged_regions_are_reported_with_their_rank": "passed", + "tests.test_model_scan_stage::test_without_a_cpg_engine_the_stage_degrades_and_records_why": "passed", + "tests.test_model_scope::test_a_census_gap_that_names_no_file_still_reaches_its_partition": "passed", + "tests.test_model_scope::test_a_fast_portion_grows_the_next_one_after_a_collapse": "passed", + "tests.test_model_scope::test_a_killed_culprit_makes_its_family_dearer_and_nothing_else": "passed", + "tests.test_model_scope::test_a_language_no_frontend_reads_demotes_only_its_own_questions": "passed", + "tests.test_model_scope::test_a_named_missing_file_demotes_only_the_questions_about_it": "passed", + "tests.test_model_scope::test_a_portion_sizer_learns_measured_costs_per_family": "passed", + "tests.test_model_scope::test_cli_sample_uses_deferred_order_not_scanned_count": "passed", + "tests.test_model_scope::test_empty_evidence_graph_census_cannot_prune_every_check": "passed", + "tests.test_model_scope::test_expired_planning_keeps_census_without_more_fact_reads": "passed", + "tests.test_model_scope::test_explicit_static_mode_overrides_legacy_evidence_toggle": "passed", + "tests.test_model_scope::test_failed_build_does_not_reload_facts_after_deadline": "passed", + "tests.test_model_scope::test_failed_build_retains_exact_unanswered_population": "passed", + "tests.test_model_scope::test_final_order_is_the_scope_and_execution_order": "passed", + "tests.test_model_scope::test_invalid_mode_and_duplicate_identity_fail_before_build": "passed", + "tests.test_model_scope::test_later_timeout_retains_raw_answer_without_claiming_arbitration": "passed", + "tests.test_model_scope::test_missing_graph_files_disable_safe_pruning_and_completion": "passed", + "tests.test_model_scope::test_only_a_request_entry_treats_its_parameters_as_attacker_input": "passed", + "tests.test_model_scope::test_outcome_and_coverage_contracts_reject_forged_completion": "passed", + "tests.test_model_scope::test_overlapping_frontend_paths_keep_ids_distinct_and_evidence_unknown": "passed", + "tests.test_model_scope::test_partial_evidence_batch_is_unknown_not_tier_zero": "passed", + "tests.test_model_scope::test_php_javascript_equivalent_vectors_produce_same_decisions[evidence]": "passed", + "tests.test_model_scope::test_php_javascript_equivalent_vectors_produce_same_decisions[static]": "passed", + "tests.test_model_scope::test_scope_payload_is_json_serializable": "passed", + "tests.test_model_scope::test_unbatched_failure_is_not_a_completed_empty_answer": "passed", + "tests.test_model_scope::test_unknown_evidence_and_family_completion_remain_separate": "passed", + "tests.test_model_scope::test_unvalidated_typescript_demotes_only_typescript_questions": "passed", + "tests.test_model_shipped::test_a_repository_with_no_readable_build_files_declares_nothing": "passed", + "tests.test_model_shipped::test_build_time_substitutions_are_skipped": "passed", + "tests.test_model_shipped::test_cmake_targets_are_read_and_their_keywords_are_not_files": "passed", + "tests.test_model_shipped::test_only_installed_targets_count_as_shipped": "passed", + "tests.test_model_specs::test_a_guard_discharges_only_the_obligation_it_is_a_guard_of": "passed", + "tests.test_model_specs::test_a_php_file_can_become_a_region": "passed", + "tests.test_model_specs::test_a_sanitizer_that_does_not_stop_sql_injection_is_not_listed": "passed", + "tests.test_model_specs::test_a_sink_is_matched_as_a_word_not_a_substring": "passed", + "tests.test_model_specs::test_a_sink_is_never_its_own_sanitizer": "passed", + "tests.test_model_specs::test_configuration_facts_do_not_become_authorization_obligations": "passed", + "tests.test_model_specs::test_constraint_params_are_not_dischargers_on_their_own": "passed", + "tests.test_model_specs::test_dischargers_carry_identity_tokens_but_not_the_negative_fields": "passed", + "tests.test_model_specs::test_input_validation_does_not_discharge_an_authorization_obligation": "passed", + "tests.test_model_specs::test_no_php_sink_is_its_own_sanitizer": "passed", + "tests.test_model_specs::test_php_facts_derive_the_families_a_web_application_needs": "passed", + "tests.test_model_specs::test_safe_shape_sinks_are_kept_for_the_shape_test": "passed", + "tests.test_model_specs::test_specs_import_nothing_from_the_removed_packages": "passed", + "tests.test_model_specs::test_the_access_control_dominance_spec_carries_operations_and_dischargers": "passed", + "tests.test_model_specs::test_the_guard_classifier_still_recognises_each_kind": "passed", + "tests.test_model_specs::test_the_guard_vocabulary_is_preserved_verbatim": "passed", + "tests.test_model_specs::test_the_injection_taint_spec_carries_sources_sinks_and_sanitizers": "passed", + "tests.test_model_specs::test_the_seeded_families_and_the_named_gaps_are_both_exact": "passed", + "tests.test_model_specs::test_the_specs_module_exposes_no_writer": "passed", + "tests.test_model_specs::test_wordpress_database_calls_are_matched_qualified": "passed", + "tests.test_model_taint::test_a_bound_that_governs_the_sink_lowers_the_rung": "passed", + "tests.test_model_taint::test_a_flow_from_a_real_source_outranks_a_shorter_one_from_a_bare_parameter": "passed", + "tests.test_model_taint::test_a_modelled_source_flow_decides_even_when_a_parameter_flow_is_unsanitized": "passed", + "tests.test_model_taint::test_a_parameterised_sink_call_is_not_a_vulnerability_even_though_the_flow_reaches_it": "passed", + "tests.test_model_taint::test_a_path_through_a_sanitizer_is_corroborated_not_entailed": "passed", + "tests.test_model_taint::test_a_query_that_failed_is_not_read_as_an_absence_of_flow": "passed", + "tests.test_model_taint::test_a_region_reports_every_sink_site_not_just_the_strongest": "passed", + "tests.test_model_taint::test_a_region_scopes_its_question_to_its_own_file": "passed", + "tests.test_model_taint::test_a_row_without_shape_fields_is_judged_on_the_flow_alone": "passed", + "tests.test_model_taint::test_a_sink_in_a_nested_closure_is_in_scope_when_the_query_says_so": "passed", + "tests.test_model_taint::test_a_sink_in_an_unrelated_function_stays_out_of_scope": "passed", + "tests.test_model_taint::test_an_interpolated_sink_call_of_the_same_name_is_entailed": "passed", + "tests.test_model_taint::test_an_unsanitized_source_to_sink_path_is_entailed": "passed", + "tests.test_model_taint::test_no_path_yields_no_verdict_so_the_caller_reports_suspicion": "passed", + "tests.test_model_taint::test_only_a_length_sink_can_be_discharged_by_a_bound": "passed", + "tests.test_model_taint::test_parameter_flows_still_decide_when_no_modelled_source_reaches_the_sink": "passed", + "tests.test_model_taint::test_parameter_sources_are_opt_in_and_reach_the_query": "passed", + "tests.test_model_taint::test_rows_without_the_scope_flag_fall_back_to_the_method_name": "passed", + "tests.test_model_taint::test_the_shape_test_only_applies_to_sinks_declared_safe_in_that_shape": "passed", + "tests.test_model_taint::test_the_shortest_unsanitized_flow_wins_and_the_sequence_is_deterministic": "passed", + "tests.test_model_taint::test_the_spec_drives_the_query_parameters": "passed", + "tests.test_model_taint::test_the_verdict_is_restricted_to_the_labeled_function": "passed", + "tests.test_model_taxonomy::test_every_labeled_corpus_cwe_resolves_and_no_cwe_is_claimed_twice": "passed", + "tests.test_model_taxonomy::test_every_mechanism_id_resolves_to_exactly_one_family": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[bad_verifier]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[cwe_claimed_twice]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[duplicate_cwe]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[fabricated_family]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[mechanism_claimed_twice]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[missing_verifier]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[no_description]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[no_version]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[unknown_field]": "passed", + "tests.test_model_taxonomy::test_loader_rejects_data_bugs_by_name[unknown_parent]": "passed", + "tests.test_model_taxonomy::test_relation_answers_same_lateral_fabricated_and_parent_child_when_declared": "passed", + "tests.test_model_taxonomy::test_taxonomy_loads_ten_families_each_with_a_verifier": "passed", + "tests.test_model_taxonomy::test_the_memory_family_states_what_it_cannot_decide": "passed", + "tests.test_model_taxonomy::test_the_shipped_file_must_declare_the_whole_closed_set_in_order": "passed", + "tests.test_module_audit::test_every_module_is_classified": "passed", + "tests.test_module_audit::test_no_module_in_the_tree_is_orphaned": "passed", + "tests.test_module_audit::test_the_manifest_matches_the_tree": "passed", + "tests.test_module_audit::test_the_named_subsystems_each_carry_an_explicit_decision": "passed", + "tests.test_mutation_fixtures::test_mutation_fixture_is_outside_stage1_gate_corpus": "passed", + "tests.test_mutation_fixtures::test_stage1_misses_aliased_os_system_mutation": "passed", + "tests.test_obligation_check::test_a_declared_public_route_never_reports_its_missing_path_guard_but_keeps_the_resource_obligation": "passed", + "tests.test_obligation_check::test_a_malformed_store_row_is_a_degradation_not_a_crash": "passed", + "tests.test_obligation_check::test_declared_policy_outranks_consistency_and_public_routes_drop_only_the_guard": "passed", + "tests.test_obligation_check::test_findings_become_suspicion_static_findings_with_labels": "passed", + "tests.test_obligation_check::test_function_local_run_reports_the_consistency_violation_with_siblings_and_a_degradation": "passed", + "tests.test_obligation_check::test_path_records_gate_reachability_and_a_dominating_hop_discharges": "passed", + "tests.test_obligation_check::test_with_path_records_an_unjustified_obligation_yields_no_finding": "passed", + "tests.test_obligation_dominance::test_order_dominance_along_a_path_uses_hop_order": "passed", + "tests.test_obligation_dominance::test_order_dominance_decorators_and_router_witnesses_dominate_the_handler": "passed", + "tests.test_obligation_dominance::test_order_dominance_statement_witness_needs_to_precede_with_an_exit_or_be_a_guard_call": "passed", + "tests.test_obligation_facts::test_default_obligation_facts_load_per_language_with_closed_kinds": "passed", + "tests.test_obligation_facts::test_flow_facts_loader_ignores_the_obligation_facts_directory": "passed", + "tests.test_obligation_facts::test_loader_rejects_kinds_and_fields_outside_the_closed_sets": "passed", + "tests.test_obligation_intent::test_malformed_or_off_vocabulary_answers_are_recorded_as_unknown": "passed", + "tests.test_obligation_intent::test_scan_records_intent_when_a_scripted_hunter_client_is_configured": "passed", + "tests.test_obligation_intent::test_scripted_client_answers_are_recorded_on_the_finding_and_change_nothing_else": "passed", + "tests.test_obligation_intent::test_the_prompt_carries_the_handler_own_lines_only_and_is_redacted": "passed", + "tests.test_obligation_intent::test_without_a_client_one_degradation_is_recorded_and_findings_are_identical": "passed", + "tests.test_obligation_operations::test_discharge_witness_covers_operation_only_when_kind_and_provenance_fit": "passed", + "tests.test_obligation_operations::test_find_discharges_reports_witness_kind_provenance_and_scope": "passed", + "tests.test_obligation_operations::test_find_operations_names_kind_fact_function_and_resource": "passed", + "tests.test_obligation_policy::test_unknown_fields_and_values_are_rejected_by_name": "passed", + "tests.test_obligation_policy::test_valid_policy_loads_with_a_version_hash": "passed", + "tests.test_obligation_reports::test_markdown_names_obligation_missing_discharger_evidence_and_known_fix": "passed", + "tests.test_obligation_reports::test_obligation_cap_binds_on_verdict_ids_because_the_pipeline_never_sets_proof_levels_on_static_findings": "passed", + "tests.test_obligation_reports::test_obligation_ranking_weighs_sensitivity_and_label_but_stays_below_proven_findings": "passed", + "tests.test_obligation_reports::test_reports_without_obligations_are_unchanged": "passed", + "tests.test_obligation_reports::test_sarif_carries_obligation_properties": "passed", + "tests.test_obligation_scan::test_declared_policy_is_read_from_the_target_and_versioned_in_the_manifest": "passed", + "tests.test_obligation_scan::test_deep_scan_never_offers_obligation_findings_to_the_sandbox": "passed", + "tests.test_obligation_scan::test_quick_scan_and_disabled_config_skip_obligations": "passed", + "tests.test_obligation_scan::test_standard_scan_emits_obligation_findings_and_the_manifest_block": "passed", + "tests.test_obligation_shapes::test_flag_toggled_twin_teaches_from_the_discharged_sibling_operation": "passed", + "tests.test_obligation_shapes::test_identity_constraint_added_on_the_fixed_side_is_the_lesson": "passed", + "tests.test_obligation_shapes::test_identity_from_request_body_pair_reports_the_fixed_provenance_and_the_label_kind_wins": "passed", + "tests.test_obligation_shapes::test_no_discharger_added_and_missing_function_return_none_with_reasons": "passed", + "tests.test_obligation_shapes::test_permissive_default_pair_yields_a_setting_shape_with_constant_provenance": "passed", + "tests.test_obligation_shapes::test_unrelated_trap_twin_teaches_from_the_vulnerable_functions_own_safe_branch": "passed", + "tests.test_obligation_siblings::test_consistency_anomalies_respect_the_minimum_and_name_the_siblings": "passed", + "tests.test_obligation_siblings::test_public_route_among_authenticated_siblings_is_a_missing_path_guard_with_access_evidence": "passed", + "tests.test_obligation_siblings::test_same_named_files_in_different_modules_are_not_siblings": "passed", + "tests.test_obligation_siblings::test_sibling_sets_group_by_router_and_resource_and_record_who_discharges": "passed", + "tests.test_opencode_skills::test_project_opencode_skills_have_required_frontmatter": "passed", + "tests.test_pair_corpus::test_agent_vfc_loads_at_title_tier_and_tiers_default_per_slice": "passed", + "tests.test_pair_corpus::test_c_function_with_return_type_on_previous_line_keeps_its_parser_name": "passed", + "tests.test_pair_corpus::test_catalog_loads_local_and_github_slices": "passed", + "tests.test_pair_corpus::test_catalog_rejects_an_obligation_kind_outside_the_closed_set": "passed", + "tests.test_pair_corpus::test_catalog_rejects_unknown_mechanism_and_sink_unknown_without_anchor": "passed", + "tests.test_pair_corpus::test_cli_new_slices_exit_zero_with_tier_profile_and_mechanism_metrics": "passed", + "tests.test_pair_corpus::test_cli_pairs_json_scoreboard": "passed", + "tests.test_pair_corpus::test_cli_pairs_pointers_flag_turns_network_on_for_one_run": "passed", + "tests.test_pair_corpus::test_cli_pairs_profile_and_split_filters": "passed", + "tests.test_pair_corpus::test_cli_vfc_json_includes_dual_scorers": "passed", + "tests.test_pair_corpus::test_containment_matches_outer_label_and_rejects_inner_label": "passed", + "tests.test_pair_corpus::test_coverage_with_source_counts_as_detection_and_as_leak": "passed", + "tests.test_pair_corpus::test_cpp_qualified_method_range_is_found_by_its_unqualified_label": "passed", + "tests.test_pair_corpus::test_cwe_only_row_is_a_weak_label_and_never_matches": "passed", + "tests.test_pair_corpus::test_datasets_catalog_lists_public_vfc_repos": "passed", + "tests.test_pair_corpus::test_declarator_name_knows_perl_subs_and_never_names_calls": "passed", + "tests.test_pair_corpus::test_declarator_name_strips_cpp_qualification_to_match_unqualified_labels": "passed", + "tests.test_pair_corpus::test_declarator_named_functions_match_their_labels[arrow]": "passed", + "tests.test_pair_corpus::test_declarator_named_functions_match_their_labels[exports]": "passed", + "tests.test_pair_corpus::test_declarator_named_functions_match_their_labels[method]": "passed", + "tests.test_pair_corpus::test_declarator_named_functions_match_their_labels[property]": "passed", + "tests.test_pair_corpus::test_default_catalog_has_the_new_slices_on_disk_and_off_the_stage1_list": "passed", + "tests.test_pair_corpus::test_function_at_skips_anonymous_and_module_ranges": "passed", + "tests.test_pair_corpus::test_function_scoped_match_rejects_detection_outside_the_named_function": "passed", + "tests.test_pair_corpus::test_github_slice_measures_real_vfc_pairs": "passed", + "tests.test_pair_corpus::test_juliet_strcpy_pair_bodies_differ_and_java_hash_is_known_limit": "passed", + "tests.test_pair_corpus::test_known_limit_pairs_are_evaluated_but_excluded_from_achievable": "passed", + "tests.test_pair_corpus::test_known_limit_pairs_emit_no_improve_signals": "passed", + "tests.test_pair_corpus::test_loader_rejects_reserved_words_as_function_labels": "passed", + "tests.test_pair_corpus::test_local_slice_clears_the_pair_gate": "passed", + "tests.test_pair_corpus::test_named_function_ranges_use_declarator_names": "passed", + "tests.test_pair_corpus::test_new_slices_load_offline_and_score_with_profiles": "passed", + "tests.test_pair_corpus::test_obligation_labeled_row_loads_and_is_detected_by_an_obligation_finding": "passed", + "tests.test_pair_corpus::test_pair_catalog_is_outside_stage1_smoke_gate": "passed", + "tests.test_pair_corpus::test_pair_signals_emit_miss_on_vuln_and_fp_on_fix": "passed", + "tests.test_pair_corpus::test_payload_reports_metrics_per_review_tier": "passed", + "tests.test_pair_corpus::test_pointer_pairs_materialize_into_the_cache_and_score_like_vendored_pairs": "passed", + "tests.test_pair_corpus::test_pointer_pairs_skip_with_a_degradation_when_network_is_off": "passed", + "tests.test_pair_corpus::test_pointer_rows_load_without_excerpts_and_point_into_the_cache": "passed", + "tests.test_pair_corpus::test_promotion_inside_a_callback_matches_the_enclosing_named_function": "passed", + "tests.test_pair_corpus::test_reviewed_tier_requires_a_reviewer_and_unknown_tiers_are_rejected": "passed", + "tests.test_pair_corpus::test_sast_slice_scores_owasp_and_juliet": "passed", + "tests.test_pair_corpus::test_sink_match_is_exact_or_alias_not_substring": "passed", + "tests.test_pair_corpus::test_synthetic_pair_fires_on_vuln_and_stays_silent_on_fix": "passed", + "tests.test_pair_corpus::test_unresolvable_function_label_is_a_visible_loss_not_a_silent_miss": "passed", + "tests.test_pair_corpus::test_vfc_rows_name_functions_and_carry_no_weak_labels": "passed", + "tests.test_pair_corpus::test_vfc_slice_is_labeled_openssl_firefox_chromium": "passed", + "tests.test_pair_corpus::test_vfc_style_slice_rows_require_a_named_function": "passed", + "tests.test_pair_corpus::test_vfc_training_manifest_has_vuln_and_fixed_labels": "passed", + "tests.test_pair_corpus::test_vibe_py_and_agent_vfc_carry_pointer_rows_and_the_default_run_skips_them": "passed", + "tests.test_pair_corpus::test_warm_cache_never_scores_pointer_pairs_when_network_is_off": "passed", + "tests.test_pair_corpus::test_weak_label_never_matches_on_inventory_fallback": "passed", + "tests.test_pair_harvest::test_agent_vfc_builder_writes_toml_booleans": "passed", + "tests.test_pair_harvest::test_catalog_gen_derives_function_past_the_provenance_header_and_never_anon": "passed", + "tests.test_pair_harvest::test_catalog_gen_emits_pointer_rows_without_excerpts": "passed", + "tests.test_pair_harvest::test_catalog_gen_fails_loud_without_the_package_and_refuses_to_prune_an_empty_catalog": "passed", + "tests.test_pair_harvest::test_catalog_gen_labels_from_sink_location_not_from_formatting_hunk": "passed", + "tests.test_pair_harvest::test_catalog_gen_prefers_declarator_names_and_rejects_reserved_words": "passed", + "tests.test_pair_harvest::test_extract_function_round_trips_a_local_body": "passed", + "tests.test_pair_harvest::test_extract_function_round_trips_perl_sub_without_parens": "passed", + "tests.test_pair_harvest::test_extract_function_skips_prototype_before_definition": "passed", + "tests.test_pair_harvest::test_extract_pair_dispatches_modes_and_validate_requires_mode_fields": "passed", + "tests.test_pair_harvest::test_extract_pair_with_lines_and_header_record_upstream_start": "passed", + "tests.test_pair_harvest::test_handler_context_mode_keeps_decorators_and_registration": "passed", + "tests.test_pair_harvest::test_harvest_dry_run_accepts_seed_recipes": "passed", + "tests.test_pair_harvest::test_hunk_mode_falls_back_to_whole_small_file": "passed", + "tests.test_pair_harvest::test_hunk_mode_python": "passed", + "tests.test_pair_harvest::test_hunk_mode_returns_enclosing_functions_on_both_sides": "passed", + "tests.test_pair_harvest::test_hunk_mode_skips_module_level_hunk_and_uses_next_function_hunk": "passed", + "tests.test_pair_harvest::test_line_range_mode_round_trips_exact_lines": "passed", + "tests.test_pair_harvest::test_materialize_pointer_writes_only_into_the_cache_root_and_needs_no_license": "passed", + "tests.test_pair_harvest::test_merge_recipes_keeps_existing_rows_and_appends_new_by_name": "passed", + "tests.test_pair_harvest::test_name_mode_ignores_doc_comment_mention_and_anchors_on_declarator": "passed", + "tests.test_pair_harvest::test_name_mode_skips_prototype_and_string_mentions": "passed", + "tests.test_pair_harvest::test_provenance_header_uses_language_comment_style": "passed", + "tests.test_pair_harvest::test_python_block_mode_cuts_by_indentation_and_keeps_decorators": "passed", + "tests.test_pair_harvest::test_python_block_survives_dedented_triple_quoted_string": "passed", + "tests.test_pair_harvest::test_validate_recipe_rejects_advisory_only_and_fixfox": "passed", + "tests.test_pair_harvest::test_vibe_py_builder_pointers_mode_emits_llm_repos_as_unvendored_agent_rows": "passed", + "tests.test_pair_harvest::test_write_excerpt_redacts_credential_literals_but_not_code": "passed", + "tests.test_pair_hygiene::test_a_declared_known_limit_wins_over_a_computed_reason": "passed", + "tests.test_pair_hygiene::test_a_leading_code_comment_is_not_a_provenance_header": "passed", + "tests.test_pair_hygiene::test_a_preprocessor_directive_is_code_not_a_provenance_header": "passed", + "tests.test_pair_hygiene::test_duplicate_bodies_across_pairs_are_reported_before_any_split": "passed", + "tests.test_pair_hygiene::test_duplicate_groups_that_cross_the_split_are_named_as_the_leak_they_are": "passed", + "tests.test_pair_hygiene::test_expected_rows_carry_an_opaque_family_label": "passed", + "tests.test_pair_hygiene::test_identical_twins_are_unscorable_and_no_row_is_dropped": "passed", + "tests.test_pair_hygiene::test_no_vendored_excerpt_loses_a_preprocessor_directive_to_the_header_strip": "passed", + "tests.test_pair_hygiene::test_pair_signals_can_be_filtered_to_one_split": "passed", + "tests.test_pair_hygiene::test_split_by_repository_assigns_undeclared_rows_by_repository_and_date": "passed", + "tests.test_pair_hygiene::test_split_by_repository_keeps_declared_splits_and_reports_straddles": "passed", + "tests.test_pair_hygiene::test_the_provenance_header_itself_is_still_stripped": "passed", + "tests.test_pair_registration_context::test_a_document_without_operation_ids_adds_no_entry_point": "passed", + "tests.test_pair_registration_context::test_a_failed_fetch_keeps_the_old_excerpt_and_records_the_reason": "passed", + "tests.test_pair_registration_context::test_a_javascript_excerpt_never_starts_in_the_middle_of_an_import": "passed", + "tests.test_pair_registration_context::test_a_multiline_router_call_names_its_handler": "passed", + "tests.test_pair_registration_context::test_absence_recipes_use_the_handler_context_mode": "passed", + "tests.test_pair_registration_context::test_an_openapi_operation_id_names_its_python_handler": "passed", + "tests.test_pair_registration_context::test_an_openapi_operation_without_security_is_public": "passed", + "tests.test_pair_registration_context::test_context_documents_are_harvested_for_both_sides": "passed", + "tests.test_pair_registration_context::test_context_documents_are_redacted_like_every_other_excerpt": "passed", + "tests.test_pair_registration_context::test_es_and_commonjs_modules_are_javascript": "passed", + "tests.test_pair_registration_context::test_every_absence_row_declares_its_family": "passed", + "tests.test_pair_registration_context::test_every_absence_row_has_a_named_handler_or_a_stated_reason": "passed", + "tests.test_pair_registration_context::test_handler_context_anchors_on_the_line_when_the_method_name_repeats": "passed", + "tests.test_pair_registration_context::test_handler_context_carries_the_class_its_framework_registers": "passed", + "tests.test_pair_registration_context::test_prose_inside_a_decorator_never_grants_a_guard": "passed", + "tests.test_pair_registration_context::test_registration_context_is_empty_when_the_document_never_names_the_handler": "passed", + "tests.test_pair_registration_context::test_registration_context_returns_a_whole_multiline_router_call": "passed", + "tests.test_pair_registration_context::test_registration_context_returns_the_openapi_operation_stanza": "passed", + "tests.test_pair_registration_context::test_the_driver_records_every_failed_fetch_with_its_reason": "passed", + "tests.test_pair_registration_context::test_the_named_absence_rows_carry_their_registration[openniw-jobs-0fc947-@router.get(\"/{job_id}\")]": "passed", + "tests.test_pair_registration_context::test_the_named_absence_rows_carry_their_registration[overleaf-with-claude-exportscontroller-3980b9-ExportsController.exportProject]": "passed", + "tests.test_pair_registration_context::test_the_named_absence_rows_carry_their_registration[threatbyte-api-v1-delete-@ns.route('/delete-user/')]": "passed", + "tests.test_pair_registration_context::test_the_named_absence_rows_carry_their_registration[threatbyte-api-v1-get-@ns.route('/profile')]": "passed", + "tests.test_pair_registration_context::test_the_named_absence_rows_carry_their_registration[vampi-books-get-by-title-operationId: api_views.books.get_by_title]": "passed", + "tests.test_pair_registration_context::test_the_named_absence_rows_carry_their_registration[vampi-users-update-password-operationId: api_views.users.update_password]": "passed", + "tests.test_pair_registration_context::test_the_overleaf_excerpt_parses_on_both_sides": "passed", + "tests.test_pair_registration_context::test_the_overleaf_pair_is_scannable_at_all": "passed", + "tests.test_pair_registration_context::test_the_vendored_count_is_unchanged_by_the_re_harvest": "passed", + "tests.test_pipeline_calibration::test_rejected_finding_demotes_its_scope_on_the_next_scan": "passed", + "tests.test_plane_ax_live::test_smoke_task_runs_and_its_runner_survives_suspend_and_resume": "skipped", + "tests.test_plane_budget::test_account_errors_are_distinct_and_carry_the_provider_message[DeepSeek chat request failed: {\"error\":{\"message\":\"Insufficient Balance\",\"type\":\"unknown_error\"}}]": "passed", + "tests.test_plane_budget::test_account_errors_are_distinct_and_carry_the_provider_message[OpenRouter chat request failed: HTTPError: HTTP Error 401: Unauthorized]": "passed", + "tests.test_plane_budget::test_account_errors_are_distinct_and_carry_the_provider_message[OpenRouter chat request failed: HTTPError: HTTP Error 402: Payment Required: {\"error\":{\"message\":\"Insufficient credits\"}}]": "passed", + "tests.test_plane_budget::test_cache_hit_pricing_is_exact_dollars": "passed", + "tests.test_plane_budget::test_calls_ceiling_stops_before_the_next_call": "passed", + "tests.test_plane_budget::test_client_without_usage_rows_still_counts_calls": "passed", + "tests.test_plane_budget::test_cost_of_honours_explicit_cache_miss_field": "passed", + "tests.test_plane_budget::test_other_provider_errors_pass_through_unchanged": "passed", + "tests.test_plane_budget::test_prices_from_accepts_manifest_parameters_and_rejects_partial_ones": "passed", + "tests.test_plane_budget::test_summary_shape_for_a_priced_model": "passed", + "tests.test_plane_budget::test_unpriced_model_refuses_a_usd_budget": "passed", + "tests.test_plane_budget::test_unpriced_model_reports_none_not_zero_under_a_calls_budget": "passed", + "tests.test_plane_budget::test_usage_sums_across_calls": "passed", + "tests.test_plane_budget::test_usd_ceiling_stops_before_the_next_call": "passed", + "tests.test_plane_budget::test_zero_calls_budget_refuses_the_first_call": "passed", + "tests.test_plane_egress::test_an_ip_receiver_is_not_granted": "passed", + "tests.test_plane_egress::test_apply_creates_reads_back_and_delete_confirms_the_cascade": "passed", + "tests.test_plane_egress::test_apply_replaces_an_existing_policy": "passed", + "tests.test_plane_egress::test_apply_waits_for_the_actor_then_gives_up": "passed", + "tests.test_plane_egress::test_deepseek_model_manifest_names_the_endpoint_host": "passed", + "tests.test_plane_egress::test_delivery_dials_the_override_with_the_url_host": "passed", + "tests.test_plane_egress::test_egress_hosts_annotation_is_validated[*.deepseek.com]": "passed", + "tests.test_plane_egress::test_egress_hosts_annotation_is_validated[10.1.2.3]": "passed", + "tests.test_plane_egress::test_egress_hosts_annotation_is_validated[API.deepseek.com]": "passed", + "tests.test_plane_egress::test_egress_hosts_annotation_is_validated[api.deepseek.com:443]": "passed", + "tests.test_plane_egress::test_egress_hosts_annotation_is_validated[https://api.deepseek.com]": "passed", + "tests.test_plane_egress::test_model_bound_task_with_git_workspaces": "passed", + "tests.test_plane_egress::test_model_free_task_gets_only_the_receiver": "passed", + "tests.test_plane_egress::test_receiver_address_modes": "passed", + "tests.test_plane_increment::test_case_record_carries_sites_in_set_and_cost_and_the_image_is_repinned": "passed", + "tests.test_plane_increment::test_committed_manifests_match_the_generator": "passed", + "tests.test_plane_increment::test_every_manifest_under_plane_loads": "passed", + "tests.test_plane_increment::test_fix_ranges_are_the_old_side_of_the_fix_diff": "passed", + "tests.test_plane_increment::test_generator_is_deterministic_and_follows_the_reference": "passed", + "tests.test_plane_increment::test_generator_refuses_a_set_the_recorded_scans_did_not_ask": "passed", + "tests.test_plane_increment::test_inputs_carry_the_validation_set": "passed", + "tests.test_plane_increment::test_model_prices_are_the_endpoint_prices": "passed", + "tests.test_plane_increment::test_templates_are_pinned_to_one_runner_image": "passed", + "tests.test_plane_increment::test_tiebreak_appends_thirty_tasks_and_keeps_the_first_sixty_byte_identical": "passed", + "tests.test_plane_increment::test_validation_run_resolves_and_renders_every_task": "passed", + "tests.test_plane_manifests::test_deepseek_without_extension_annotation_is_rejected": "passed", + "tests.test_plane_manifests::test_git_commit_is_rejected_with_a_pointer_to_the_annotation": "passed", + "tests.test_plane_manifests::test_git_commits_annotation_is_validated[other=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-\"other\" names no spec.git entry]": "passed", + "tests.test_plane_manifests::test_git_commits_annotation_is_validated[repo-item \"repo\" must be]": "passed", + "tests.test_plane_manifests::test_git_commits_annotation_is_validated[repo=abc123-\"repo=abc123\" is not a 40-hex commit]": "passed", + "tests.test_plane_manifests::test_git_depth_must_be_an_integer": "passed", + "tests.test_plane_manifests::test_load_manifests_reads_multi_document_files": "passed", + "tests.test_plane_manifests::test_load_manifests_rejects_duplicate_names_and_bad_files": "passed", + "tests.test_plane_manifests::test_manifests_are_frozen": "passed", + "tests.test_plane_manifests::test_metadata_takes_ax_names_only[creation_timestamp]": "passed", + "tests.test_plane_manifests::test_metadata_takes_ax_names_only[labels]": "passed", + "tests.test_plane_manifests::test_metadata_takes_ax_names_only[namespace]": "passed", + "tests.test_plane_manifests::test_missing_name_is_named": "passed", + "tests.test_plane_manifests::test_model_ax_providers_need_no_annotation[anthropic]": "passed", + "tests.test_plane_manifests::test_model_ax_providers_need_no_annotation[google]": "passed", + "tests.test_plane_manifests::test_model_loads_with_declared_extension": "passed", + "tests.test_plane_manifests::test_model_requires_model_name": "passed", + "tests.test_plane_manifests::test_run_budget_types_are_named": "passed", + "tests.test_plane_manifests::test_run_cycle_is_named": "passed", + "tests.test_plane_manifests::test_run_cycle_through_inputs_is_named": "passed", + "tests.test_plane_manifests::test_run_depends_on_unknown_task_is_named": "passed", + "tests.test_plane_manifests::test_run_duplicate_task_name_is_named": "passed", + "tests.test_plane_manifests::test_run_input_must_be_task_slash_artifact": "passed", + "tests.test_plane_manifests::test_run_input_naming_unknown_task_is_named": "passed", + "tests.test_plane_manifests::test_run_loads_graph": "passed", + "tests.test_plane_manifests::test_run_self_dependency_is_a_cycle": "passed", + "tests.test_plane_manifests::test_run_task_naming_no_loaded_task_is_named": "passed", + "tests.test_plane_manifests::test_run_without_tasks_is_rejected": "passed", + "tests.test_plane_manifests::test_task_loads_every_ax_field": "passed", + "tests.test_plane_manifests::test_task_minimal_defaults": "passed", + "tests.test_plane_manifests::test_task_type_errors_are_named": "passed", + "tests.test_plane_manifests::test_the_bring_up_smoke_manifest_loads": "passed", + "tests.test_plane_manifests::test_the_shipped_smoke_manifest_matches_the_fixture": "skipped", + "tests.test_plane_manifests::test_unknown_kind_and_non_mapping_are_rejected": "passed", + "tests.test_plane_manifests::test_unknown_metadata_field_is_named": "passed", + "tests.test_plane_manifests::test_unknown_nested_fields_are_named_with_index": "passed", + "tests.test_plane_manifests::test_unknown_provider_is_rejected_even_with_annotation": "passed", + "tests.test_plane_manifests::test_unknown_spec_field_is_named": "passed", + "tests.test_plane_manifests::test_unknown_top_level_field_is_named": "passed", + "tests.test_plane_manifests::test_workspace_loads": "passed", + "tests.test_plane_manifests::test_wrong_api_version_is_named": "passed", + "tests.test_plane_reconciler::test_a_megabyte_producer_artifact_keeps_every_rendered_value_under_substrates_limit": "passed", + "tests.test_plane_reconciler::test_a_missing_producer_artifact_fails_the_consumer_instead_of_running_it": "passed", + "tests.test_plane_reconciler::test_a_model_bound_task_without_its_secret_fails_before_ax_sees_it": "passed", + "tests.test_plane_reconciler::test_a_refused_egress_policy_fails_the_task_before_resume": "passed", + "tests.test_plane_reconciler::test_a_refused_start_fails_the_task_with_the_runners_answer": "passed", + "tests.test_plane_reconciler::test_a_rerun_of_a_run_that_gained_tasks_runs_only_the_new_ones": "passed", + "tests.test_plane_reconciler::test_a_task_that_vanishes_before_delivery_is_failed": "passed", + "tests.test_plane_reconciler::test_ax_failed_phase_before_delivery_fails_with_the_condition_message": "passed", + "tests.test_plane_reconciler::test_ax_task_names_leave_room_for_the_template_suffix": "passed", + "tests.test_plane_reconciler::test_chain_runs_in_order_with_inputs_env_and_model": "passed", + "tests.test_plane_reconciler::test_cli_wires_plane_subcommands": "passed", + "tests.test_plane_reconciler::test_delivery_for_a_task_that_is_not_running_is_rejected": "passed", + "tests.test_plane_reconciler::test_doctor_names_the_bring_up_script_when_nothing_is_reachable": "passed", + "tests.test_plane_reconciler::test_doctor_treats_an_empty_namespace_as_not_ready": "passed", + "tests.test_plane_reconciler::test_egress_policy_between_apply_and_resume_and_checked_after_delete": "passed", + "tests.test_plane_reconciler::test_elapsed_polling_is_paced": "passed", + "tests.test_plane_reconciler::test_failed_task_halts_the_run": "passed", + "tests.test_plane_reconciler::test_lock_refuses_a_second_runner_and_ignores_a_dead_one": "passed", + "tests.test_plane_reconciler::test_no_delivery_within_the_task_timeout_is_failed": "passed", + "tests.test_plane_reconciler::test_outcome_of_needs_a_delivered_summary": "passed", + "tests.test_plane_reconciler::test_receiver_rejects_traversal_unknown_tasks_and_wrong_types": "passed", + "tests.test_plane_reconciler::test_receiver_serves_a_running_task_its_declared_inputs_only": "passed", + "tests.test_plane_reconciler::test_reconciler_is_under_500_lines_and_holds_no_pipeline_logic": "passed", + "tests.test_plane_reconciler::test_rendered_documents_carry_only_ax_fields": "passed", + "tests.test_plane_reconciler::test_resume_gives_up_after_the_resume_timeout_with_the_last_error": "passed", + "tests.test_plane_reconciler::test_resume_retries_deadline_exceeded_and_completion_is_the_delivery": "passed", + "tests.test_plane_reconciler::test_serialize_label_never_overlaps_but_others_do": "passed", + "tests.test_plane_reconciler::test_start_is_sent_once_after_resume_with_the_models_credential": "passed", + "tests.test_plane_reconciler::test_status_of_an_unknown_run_says_so": "passed", + "tests.test_plane_reconciler::test_status_prints_attribution_from_usage_fields_only": "passed", + "tests.test_plane_reconciler::test_summary_done_requires_every_unit": "passed", + "tests.test_plane_reconciler::test_the_task_is_applied_after_everything_it_binds": "passed", + "tests.test_plane_reconciler::test_unfinished_stops_dependants_and_rerun_skips_done": "passed", + "tests.test_plane_reconciler::test_workspaces_one_manifest_per_case_pin": "passed", + "tests.test_plane_repo_facts::test_callers_are_capped_at_forty_per_function": "passed", + "tests.test_plane_repo_facts::test_cross_file_callers_have_line_and_enclosing_function": "passed", + "tests.test_plane_repo_facts::test_declaration_patterns_per_language[go-func (r *Repo) Get(id int) error {\\n}\\nfunc main() {\\n}\\n-expected4]": "passed", + "tests.test_plane_repo_facts::test_declaration_patterns_per_language[java-public class A {\\n public static List names(int n) throws IOException {\\n }\\n private void go() {\\n return foo(1);\\n }\\n else if (x) {\\n }\\n}\\n-expected3]": "passed", + "tests.test_plane_repo_facts::test_declaration_patterns_per_language[javascript-export async function fetchAll() {}\\nconst handler = async (req, res) => {\\n};\\nclass K {\\n save(data) {\\n }\\n}\\nif (x) {\\n}\\n-expected1]": "passed", + "tests.test_plane_repo_facts::test_declaration_patterns_per_language[php- {\\n};\\nfunction* gen() {}\\n-expected2]": "passed", + "tests.test_plane_repo_facts::test_enclosing_function_in_python_respects_indentation": "passed", + "tests.test_plane_repo_facts::test_every_function_is_a_candidate_when_none_are_given": "passed", + "tests.test_plane_repo_facts::test_main_reads_candidates_from_the_input_env": "passed", + "tests.test_plane_repo_facts::test_main_without_a_workspace_fails_with_a_summary": "passed", + "tests.test_plane_repo_facts::test_output_is_byte_identical_on_a_second_run": "passed", + "tests.test_plane_repo_facts::test_product_files_exclude_tests_vendor_bundles_and_dotdirs": "passed", + "tests.test_plane_repo_facts::test_resume_recomputes_only_the_missing_unit": "passed", + "tests.test_plane_repo_facts::test_resume_skips_files_already_in_units": "passed", + "tests.test_plane_repo_facts::test_rows_from_another_candidate_set_are_not_reused": "passed", + "tests.test_plane_repo_facts::test_same_file_calls_and_declaration_lines_are_not_callers": "passed", + "tests.test_plane_repo_facts::test_summary_is_never_done_when_a_unit_is_missing": "passed", + "tests.test_plane_router::test_a_409_is_raised_at_once_with_the_response_text_redacted[fake_router0]": "passed", + "tests.test_plane_router::test_a_failing_port_forward_raises_with_kubectls_output": "passed", + "tests.test_plane_router::test_a_restart_after_re_resume_accepts_a_running_command[fake_router0]": "passed", + "tests.test_plane_router::test_connection_errors_are_retried_until_the_timeout": "passed", + "tests.test_plane_router::test_credentials_come_from_the_models_secret_key_variable": "passed", + "tests.test_plane_router::test_port_forward_port_is_parsed_and_the_child_is_terminated_on_exit": "passed", + "tests.test_plane_router::test_router_url_override_starts_no_port_forward": "passed", + "tests.test_plane_router::test_start_gives_up_after_the_start_timeout[fake_router0]": "passed", + "tests.test_plane_router::test_start_retries_503_and_502_then_succeeds[fake_router0]": "passed", + "tests.test_plane_runner::test_a_bound_workspace_missing_from_the_stream_fails_before_the_task": "passed", + "tests.test_plane_runner::test_a_crash_that_prints_the_credential_is_redacted": "passed", + "tests.test_plane_runner::test_a_crash_yields_failed_with_the_traceback": "passed", + "tests.test_plane_runner::test_a_failed_delivery_is_retried_alone_on_the_next_boot": "passed", + "tests.test_plane_runner::test_a_materialised_repo_survives_a_resume": "passed", + "tests.test_plane_runner::test_a_pin_naming_no_bound_git_entry_fails_the_task": "passed", + "tests.test_plane_runner::test_an_input_that_cannot_be_fetched_delivers_a_failed_summary_and_never_runs_the_command": "passed", + "tests.test_plane_runner::test_an_unknown_task_module_is_failed": "passed", + "tests.test_plane_runner::test_clone_destination_follows_ax_setup[code-https://github.com/chalk/chalk.git-.-/ws]": "passed", + "tests.test_plane_runner::test_clone_destination_follows_ax_setup[code-https://github.com/chalk/chalk.git-/elsewhere-/elsewhere]": "passed", + "tests.test_plane_runner::test_clone_destination_follows_ax_setup[code-https://github.com/chalk/chalk.git-None-/ws/code]": "passed", + "tests.test_plane_runner::test_clone_destination_follows_ax_setup[code-https://github.com/chalk/chalk.git-src-/ws/src]": "passed", + "tests.test_plane_runner::test_clone_destination_follows_ax_setup[origin-git@github.com:chalk/chalk-None-/ws/chalk]": "passed", + "tests.test_plane_runner::test_clone_destination_follows_ax_setup[repo-https://github.com/chalk/chalk.git-None-/ws/chalk]": "passed", + "tests.test_plane_runner::test_deliver_retries_on_connection_errors_then_raises": "passed", + "tests.test_plane_runner::test_delivery_failure_is_reported_as_failed_with_exit_2": "passed", + "tests.test_plane_runner::test_env_contract_on_a_files_workspace": "passed", + "tests.test_plane_runner::test_exit_code_follows_the_summary_status[done-0]": "passed", + "tests.test_plane_runner::test_exit_code_follows_the_summary_status[exit-2]": "passed", + "tests.test_plane_runner::test_exit_code_follows_the_summary_status[failed-2]": "passed", + "tests.test_plane_runner::test_exit_code_follows_the_summary_status[nosummary-2]": "passed", + "tests.test_plane_runner::test_exit_code_follows_the_summary_status[unfinished-3]": "passed", + "tests.test_plane_runner::test_fetch_dials_the_override_and_sends_the_url_host": "passed", + "tests.test_plane_runner::test_git_commits_annotation_round_trips_to_the_checkout": "passed", + "tests.test_plane_runner::test_git_dir_and_depth_are_honoured": "passed", + "tests.test_plane_runner::test_git_entry_is_exported_from_the_case_cache_at_the_pin": "passed", + "tests.test_plane_runner::test_git_entry_without_a_cache_is_shallow_cloned_at_the_pin": "passed", + "tests.test_plane_runner::test_http_off_without_autostart_is_refused": "passed", + "tests.test_plane_runner::test_inputs_are_fetched_from_the_receiver_before_the_command": "passed", + "tests.test_plane_runner::test_main_serves_readiness_on_a_free_port_and_the_task_sees_200": "passed", + "tests.test_plane_runner::test_output_dir_is_delivered_as_a_tar_with_the_headers": "passed", + "tests.test_plane_runner::test_readyz_is_503_until_workspaces_are_ready_then_200": "passed", + "tests.test_plane_runner::test_run_header_is_absent_without_ousast_run": "passed", + "tests.test_plane_runner::test_sigterm_goes_to_the_commands_group_then_sigkill_after_the_grace": "passed", + "tests.test_plane_runner::test_start_before_the_workspaces_are_ready_is_503_and_a_delivered_run_refuses_it": "passed", + "tests.test_plane_runner::test_the_command_is_a_child_in_its_own_group_in_the_first_workspace": "passed", + "tests.test_plane_runner::test_the_command_waits_for_the_start_request_and_the_credential_reaches_only_the_child": "passed", + "tests.test_plane_runner::test_the_completion_marker_prevents_a_rerun_on_resume": "passed", + "tests.test_plane_runner::test_the_golden_boot_never_runs_the_command": "passed", + "tests.test_plane_runner::test_the_runner_accepts_what_ax_hands_it": "passed", + "tests.test_plane_runner::test_the_runner_keeps_serving_after_the_command_and_exits_0_on_sigterm": "passed", + "tests.test_plane_runner::test_unreadable_pins_fail_the_task": "passed", + "tests.test_plane_runner::test_workspace_dir_from_the_task_env_is_kept": "passed", + "tests.test_plane_runner::test_workspaces_are_prepared_only_after_the_start_request": "passed", + "tests.test_plane_scoring_parity::test_agree_on_the_reference_outputs_reproduces_the_reference_numbers": "passed", + "tests.test_plane_scoring_parity::test_committed_ranges_are_the_reference_hunks": "passed", + "tests.test_plane_scoring_parity::test_matching_verdicts_are_identical_on_the_recorded_outputs": "passed", + "tests.test_plane_tiebreak::test_a_and_c_agreeing_flips_a_disputed_candidate_to_agreed": "passed", + "tests.test_plane_tiebreak::test_agree_main_reads_pass_c": "passed", + "tests.test_plane_tiebreak::test_an_empty_restriction_is_done_with_zero_units_and_no_call": "passed", + "tests.test_plane_tiebreak::test_b_and_c_agreeing_flips_to_agreed_and_a_lone_a_is_rejected": "passed", + "tests.test_plane_tiebreak::test_main_with_an_empty_only_list_needs_no_model_client": "passed", + "tests.test_plane_tiebreak::test_only_names_reads_disputed_json_rows_and_names": "passed", + "tests.test_plane_tiebreak::test_only_restricts_the_hunt_to_the_named_candidates": "passed", + "tests.test_plane_tiebreak::test_pass_c_alone_never_decides": "passed", + "tests.test_plane_tiebreak::test_without_pass_c_the_a_b_rule_and_numbers_are_unchanged": "passed", + "tests.test_plane_verify::test_a_budget_stop_yields_unfinished_and_resumes_under_a_larger_one": "passed", + "tests.test_plane_verify::test_a_scripted_402_yields_failed_with_the_provider_message": "passed", + "tests.test_plane_verify::test_agree_main_reads_the_env_contract": "passed", + "tests.test_plane_verify::test_agree_over_two_scripted_passes_computes_agreement_and_metrics": "passed", + "tests.test_plane_verify::test_agree_reports_cost_with_the_recorded_triage_and_needs_fix_ranges_to_assess_sites": "passed", + "tests.test_plane_verify::test_agree_without_sites_leaves_site_matching_unassessed_and_flags_unasked_candidates": "passed", + "tests.test_plane_verify::test_an_unpriced_model_reports_usd_none_not_zero": "passed", + "tests.test_plane_verify::test_main_runs_the_env_contract_with_the_scripted_seam": "passed", + "tests.test_plane_verify::test_matches_declared_is_the_protocol_v2_rule": "passed", + "tests.test_plane_verify::test_prompt_carries_the_known_callers_line_capped_at_eight": "passed", + "tests.test_plane_verify::test_resume_asks_only_the_unfinished_file": "passed", + "tests.test_plane_verify::test_summary_records_the_bound_model_and_summed_usage": "passed", + "tests.test_plane_verify::test_units_are_one_row_per_file_hunt_with_anchored_sites": "passed", + "tests.test_plane_verify::test_without_facts_the_prompt_is_the_reference_prompt": "passed", + "tests.test_policy::test_assert_rules_resolve_fails_loud_on_unmapped_enabled_rule": "passed", + "tests.test_policy::test_builtin_rules_all_resolve_in_policy": "passed", + "tests.test_policy::test_load_policy_parses_severity_and_scope": "passed", + "tests.test_policy::test_resolve_severity_is_policy_governed_and_identical_for_same_cwe": "passed", + "tests.test_preprocess::test_detect_language_uses_shebang": "passed", + "tests.test_preprocess::test_preprocess_emits_file_targets_with_tags": "passed", + "tests.test_profiling::test_the_sampler_names_the_function_that_holds_the_time": "passed", + "tests.test_provenance::test_agent_config_file_makes_tree_mixed": "passed", + "tests.test_provenance::test_empty_tree_is_human_with_no_signals": "passed", + "tests.test_provenance::test_git_trailer_share_over_threshold_is_agent": "passed", + "tests.test_provenance::test_git_unavailable_is_a_signal_not_an_error": "passed", + "tests.test_provenance::test_lovable_marker_in_index_html": "passed", + "tests.test_provenance::test_scan_never_reports_synthetic": "passed", + "tests.test_provider_retry::test_a_body_that_stops_mid_read_is_transient": "passed", + "tests.test_provider_retry::test_a_read_failure_is_reported_as_a_provider_error_not_a_raw_http_exception": "passed", + "tests.test_provider_retry::test_backoff_is_exponential": "passed", + "tests.test_provider_retry::test_does_not_retry_non_transient_http_4xx": "passed", + "tests.test_provider_retry::test_non_retryable_value_error_propagates_immediately": "passed", + "tests.test_provider_retry::test_raises_after_exhausting_attempts": "passed", + "tests.test_provider_retry::test_retries_transient_http_5xx": "passed", + "tests.test_provider_retry::test_retries_transient_then_succeeds": "passed", + "tests.test_push_admission::test_a_declaration_naming_the_call_now_covers_an_assigned_call": "passed", + "tests.test_push_admission::test_ambiguous_capability_declarations_fail_closed": "passed", + "tests.test_push_admission::test_an_operation_the_change_introduced_is_a_supported_change_basis": "passed", + "tests.test_push_admission::test_comparison_ownership_cannot_be_rebound_to_another_base_or_semantics": "passed", + "tests.test_push_admission::test_dedup_preserves_witnesses_and_comparisons_and_does_not_dismiss_printed_before": "passed", + "tests.test_push_admission::test_equivalent_origins_admit_same_claim_and_only_block_when_enabled[javascript-express]": "passed", + "tests.test_push_admission::test_equivalent_origins_admit_same_claim_and_only_block_when_enabled[php-wordpress]": "passed", + "tests.test_push_admission::test_evaluated_operation_matching_preserves_receiver_and_symbol_boundaries[custom.exec(command)]": "passed", + "tests.test_push_admission::test_evaluated_operation_matching_preserves_receiver_and_symbol_boundaries[execSync(command)]": "passed", + "tests.test_push_admission::test_evaluated_operation_matching_preserves_receiver_and_symbol_boundaries[query('exec(command)')]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-capability_disabled]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-capability_unavailable0]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-capability_unavailable1]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-capability_unavailable2]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-capability_unevaluated0]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-capability_unevaluated1]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-consequence_unsupported]": "passed", + "tests.test_push_admission::test_evaluated_semantics_and_grounded_repairs_required[-repair_unsupported]": "passed", + "tests.test_push_admission::test_missing_or_different_evaluated_operation_binding_is_diagnostic[symbols0]": "passed", + "tests.test_push_admission::test_missing_or_different_evaluated_operation_binding_is_diagnostic[symbols1]": "passed", + "tests.test_push_admission::test_missing_or_different_evaluated_operation_binding_is_diagnostic[symbols2]": "passed", + "tests.test_push_admission::test_no_default_eligibility_and_unsupported_origin_is_a_coverage_gap": "passed", + "tests.test_push_admission::test_pass_label_without_evaluation_population_is_not_eligibility[calibration_artifact-None]": "passed", + "tests.test_push_admission::test_pass_label_without_evaluation_population_is_not_eligibility[positive_controls-0]": "passed", + "tests.test_push_admission::test_pass_label_without_evaluation_population_is_not_eligibility[reviewed_alerts-0]": "passed", + "tests.test_push_admission::test_pass_label_without_evaluation_population_is_not_eligibility[untouched_workload-None]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-capability_unavailable]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-change_unsupported]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-claim_discharged]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-comparison_unknown]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-dependency_unresolved]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-insufficient_rung0]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-insufficient_rung1]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-insufficient_rung2]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-location_unresolved]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-sanitizer_semantics_mismatch]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-unchanged]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-witness_unresolved0]": "passed", + "tests.test_push_admission::test_rejected_claims_remain_diagnostics[-witness_unresolved1]": "passed", + "tests.test_push_admission::test_sql_operation_cannot_acquire_shell_consequence_from_same_family": "passed", + "tests.test_push_admission::test_the_operation_symbol_comes_from_the_call_not_the_statement": "passed", + "tests.test_push_admission::test_unchanged_on_one_base_does_not_suppress_new_on_another": "passed", + "tests.test_push_admission::test_unknown_novelty_is_coverage_but_unchanged_debt_is_not": "passed", + "tests.test_push_assistance::test_default_never_resolves_endpoint": "passed", + "tests.test_push_assistance::test_delayed_model_cannot_extend_deadline": "passed", + "tests.test_push_assistance::test_existing_endpoint_adapter_and_cost_receipt[False]": "passed", + "tests.test_push_assistance::test_existing_endpoint_adapter_and_cost_receipt[True]": "passed", + "tests.test_push_assistance::test_explicit_config_does_not_read_project_dotenv": "passed", + "tests.test_push_assistance::test_misleading_response_cannot_create_claims[{\"rung\":\"execution_confirmed\",\"finding\":\"invented\"}]": "passed", + "tests.test_push_assistance::test_misleading_response_cannot_create_claims[{\"selections\":[{\"defect_id\":\"defect-0\",\"witness_index\":999}]}]": "passed", + "tests.test_push_assistance::test_misleading_response_cannot_create_claims[{\"selections\":[{\"defect_id\":\"new-defect\",\"witness_index\":0}]}]": "passed", + "tests.test_push_assistance::test_only_existing_witness_can_be_selected_and_input_redacted": "passed", + "tests.test_push_assistance::test_selected_witness_keeps_its_location_and_change_binding": "passed", + "tests.test_push_assistance::test_selected_witness_rendering_redacts_known_secret": "passed", + "tests.test_push_assistance::test_unadmitted_candidates_never_sent": "passed", + "tests.test_push_cache::test_abandoned_partial_files_count_toward_size_and_are_evicted": "passed", + "tests.test_push_cache::test_another_writer_forces_a_rescan_and_the_limit_holds": "passed", + "tests.test_push_cache::test_completed_publication_is_readable_and_private": "passed", + "tests.test_push_cache::test_concurrent_writers_publish_only_complete_payloads": "passed", + "tests.test_push_cache::test_eviction_skips_leases_and_enforces_limit": "passed", + "tests.test_push_cache::test_interrupted_publication_never_creates_complete_entry": "passed", + "tests.test_push_cache::test_lock_wait_cannot_exceed_transaction_budget": "passed", + "tests.test_push_cache::test_lookup_failure_is_miss_and_consumer_exception_is_preserved": "passed", + "tests.test_push_cache::test_partial_and_corrupt_entries_are_misses": "passed", + "tests.test_push_cache::test_publications_reuse_one_scan_and_keep_an_exact_tally": "passed", + "tests.test_push_cache::test_symlink_and_invalid_key_are_rejected": "passed", + "tests.test_push_cache_semantics::test_final_results_bind_scope_and_current_admission_provenance": "passed", + "tests.test_push_cache_semantics::test_json_evidence_retains_provenance_and_rejects_incomplete": "passed", + "tests.test_push_cache_semantics::test_query_and_result_invalidation_layers": "passed", + "tests.test_push_contracts::test_config_round_trip_and_ordinary_scan_compatibility": "passed", + "tests.test_push_contracts::test_contract_round_trips_preserve_partition_ref_and_comparison_identity": "passed", + "tests.test_push_contracts::test_deletion_only_result_is_explicitly_not_applicable": "passed", + "tests.test_push_contracts::test_direct_mutable_collection_is_not_an_immutable_contract": "passed", + "tests.test_push_contracts::test_empty_population_needs_an_explicit_census_assertion": "passed", + "tests.test_push_contracts::test_execution_budget_requires_finite_clock_and_distinct_positive_allowance": "passed", + "tests.test_push_contracts::test_generic_contracts_and_engine_do_not_depend_on_push": "passed", + "tests.test_push_contracts::test_graph_partial_provenance_stays_partial_and_options_are_preserved": "passed", + "tests.test_push_contracts::test_graph_provenance_round_trip_and_live_lease_separation": "passed", + "tests.test_push_contracts::test_incomplete_scope_cannot_be_serialized_as_complete_negative": "passed", + "tests.test_push_contracts::test_malformed_identity_payloads_fail[value0]": "passed", + "tests.test_push_contracts::test_malformed_identity_payloads_fail[value1]": "passed", + "tests.test_push_contracts::test_malformed_identity_payloads_fail[value2]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ncache_max_bytes = 0]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ncache_max_bytes = 1.5]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ncache_max_bytes = true]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ncancellation_allowance_seconds = -1]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ncomparison_base = \"\"]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ncomparison_base = 1]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ndeadline_second = 60]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ndeadline_seconds = \"30\"]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ndeadline_seconds = 0]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ndeadline_seconds = inf]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ndeadline_seconds = nan]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\ndeadline_seconds = true]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\nincomplete_coverage_policy = \"ignore\"]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[[push]\\nmode = \"nag\"]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[push = \"bad\"]": "passed", + "tests.test_push_contracts::test_push_configuration_rejects_unsafe_coercion[push = []]": "passed", + "tests.test_push_contracts::test_result_rejects_unknown_status_vocabulary[coverage_status-None]": "passed", + "tests.test_push_contracts::test_result_rejects_unknown_status_vocabulary[coverage_status-secure]": "passed", + "tests.test_push_contracts::test_result_rejects_unknown_status_vocabulary[finding_status-True]": "passed", + "tests.test_push_contracts::test_result_rejects_unknown_status_vocabulary[finding_status-clean]": "passed", + "tests.test_push_contracts::test_result_rejects_unknown_status_vocabulary[push_disposition-warn]": "passed", + "tests.test_push_contracts::test_result_statuses_are_independent[actionable-complete_within_scope-block]": "passed", + "tests.test_push_contracts::test_result_statuses_are_independent[actionable-incomplete-allow]": "passed", + "tests.test_push_contracts::test_result_statuses_are_independent[none-incomplete-allow]": "passed", + "tests.test_push_contracts::test_result_statuses_are_independent[none-unavailable-block]": "passed", + "tests.test_push_contracts::test_shared_head_does_not_merge_different_base_completion": "passed", + "tests.test_push_contracts::test_strict_runtime_construction_not_only_decoding": "passed", + "tests.test_push_eligibility::test_changed_semantic_advice_needs_a_new_frozen_review": "passed", + "tests.test_push_eligibility::test_matching_reviewed_synthetic_population_can_be_loaded": "passed", + "tests.test_push_eligibility::test_missing_joint_evidence_never_enables_advisory[no_alert]": "passed", + "tests.test_push_eligibility::test_missing_joint_evidence_never_enables_advisory[no_independent]": "passed", + "tests.test_push_eligibility::test_missing_joint_evidence_never_enables_advisory[no_positive]": "passed", + "tests.test_push_eligibility::test_missing_joint_evidence_never_enables_advisory[runtime]": "passed", + "tests.test_push_eligibility::test_missing_joint_evidence_never_enables_advisory[stale_runtime]": "passed", + "tests.test_push_eligibility::test_missing_joint_evidence_never_enables_advisory[wrong_semantics]": "passed", + "tests.test_push_eligibility::test_runner_consumes_only_matching_registry": "passed", + "tests.test_push_eligibility::test_shipped_registry_is_reproducible_no_go": "passed", + "tests.test_push_eligibility::test_stale_or_tampered_registry_is_rejected": "passed", + "tests.test_push_experiment::test_authored_snapshot_keeps_whole_tree_and_original_repository": "passed", + "tests.test_push_experiment::test_timeout_stays_unresolved_and_uses_whole_cli_elapsed_time": "passed", + "tests.test_push_experiment::test_zero_cli_exit_cannot_earn_negative_without_witness": "passed", + "tests.test_push_feasibility::test_duplicate_or_unplanned_measurement_is_rejected": "passed", + "tests.test_push_feasibility::test_identical_tip_alone_cannot_qualify_runtime": "passed", + "tests.test_push_feasibility::test_invalid_elapsed_is_an_instrument_error[-1]": "passed", + "tests.test_push_feasibility::test_invalid_elapsed_is_an_instrument_error[inf]": "passed", + "tests.test_push_feasibility::test_invalid_elapsed_is_an_instrument_error[nan]": "passed", + "tests.test_push_feasibility::test_multi_ref_target_denominator_is_fixed_before_execution": "passed", + "tests.test_push_feasibility::test_timeouts_and_missing_runs_remain_in_fixed_population": "passed", + "tests.test_push_hook::test_chain_preserves_exact_nonzero_even_for_advisory": "passed", + "tests.test_push_hook::test_existing_hook_stdin_remote_exit_and_removal[0]": "passed", + "tests.test_push_hook::test_existing_hook_stdin_remote_exit_and_removal[7]": "passed", + "tests.test_push_hook::test_install_refuses_dangling_symlink": "passed", + "tests.test_push_hook::test_install_refuses_existing_and_honors_hooks_path": "passed", + "tests.test_push_inputs::test_authored_edit_requires_exact_original_and_provenance": "passed", + "tests.test_push_inputs::test_empty_population_rejected[cases]": "passed", + "tests.test_push_inputs::test_empty_population_rejected[snapshots]": "passed", + "tests.test_push_inputs::test_immutable_bytes_ignore_dirty_worktree": "passed", + "tests.test_push_inputs::test_invalid_input_keeps_case_in_population[empty]": "passed", + "tests.test_push_inputs::test_invalid_input_keeps_case_in_population[escape]": "passed", + "tests.test_push_inputs::test_invalid_input_keeps_case_in_population[hash]": "passed", + "tests.test_push_inputs::test_invalid_input_keeps_case_in_population[missing]": "passed", + "tests.test_push_inputs::test_invalid_input_keeps_case_in_population[ref]": "passed", + "tests.test_push_inputs::test_invalid_label_rejected": "passed", + "tests.test_push_inputs::test_missing_holdout_labels_never_qualify_capability": "passed", + "tests.test_push_inputs::test_missing_language_holdouts_retained": "passed", + "tests.test_push_inputs::test_missing_snapshot_identity_rejected": "passed", + "tests.test_push_inputs::test_unavailable_source_is_explicit": "passed", + "tests.test_push_interface::test_all_refs_deduplicated_and_missing_base_retained": "passed", + "tests.test_push_interface::test_cli_reads_git_stdin": "passed", + "tests.test_push_interface::test_distinct_comparisons_share_deadline": "passed", + "tests.test_push_interface::test_input_wait_is_inside_deadline": "passed", + "tests.test_push_interface::test_no_work[(delete) {zero} refs/heads/old {base}\\n]": "passed", + "tests.test_push_interface::test_no_work[]": "passed", + "tests.test_push_interface::test_transaction_enforcement_and_dedup[advisory-allow-True-0]": "passed", + "tests.test_push_interface::test_transaction_enforcement_and_dedup[advisory-block-False-0]": "passed", + "tests.test_push_interface::test_transaction_enforcement_and_dedup[blocking-allow-False-0]": "passed", + "tests.test_push_interface::test_transaction_enforcement_and_dedup[blocking-allow-True-1]": "passed", + "tests.test_push_interface::test_transaction_enforcement_and_dedup[blocking-block-False-1]": "passed", + "tests.test_push_policy::test_a_candidate_without_an_operation_reports_no_dependency_gaps": "passed", + "tests.test_push_policy::test_a_declared_exclusion_boundary_does_not_block_either": "passed", + "tests.test_push_policy::test_a_declared_exclusion_does_not_block_a_comparison_on_either_side": "passed", + "tests.test_push_policy::test_a_gap_from_another_language_partition_does_not_block_admission": "passed", + "tests.test_push_policy::test_a_malformed_inventory_row_is_not_an_empty_inventory": "passed", + "tests.test_push_policy::test_a_non_reachability_base_gap_still_blocks_an_enumerated_absence": "passed", + "tests.test_push_policy::test_a_present_operation_still_refuses_novelty_under_bounded_reachability": "passed", + "tests.test_push_policy::test_a_reachability_derived_enumeration_cannot_establish_absence_while_bounded": "passed", + "tests.test_push_policy::test_a_reachability_derived_enumeration_is_usable_when_reachability_is_complete": "passed", + "tests.test_push_policy::test_a_recorded_dependency_of_the_counterpart_must_also_be_complete": "passed", + "tests.test_push_policy::test_a_traced_flow_absence_still_requires_complete_reachability": "passed", + "tests.test_push_policy::test_absence_from_a_structural_enumeration_survives_bounded_reachability": "passed", + "tests.test_push_policy::test_ambiguous_correspondence_on_a_changed_line_is_never_new": "passed", + "tests.test_push_policy::test_an_empty_but_enumerated_scope_establishes_absence": "passed", + "tests.test_push_policy::test_an_enumerated_base_without_the_operation_establishes_absence": "passed", + "tests.test_push_policy::test_an_integrity_degradation_is_this_candidate_s_dependency": "passed", + "tests.test_push_policy::test_an_integrity_degradation_still_blocks_a_comparison": "passed", + "tests.test_push_policy::test_an_operation_needing_an_ambiguous_anchor_is_still_uncomparable": "passed", + "tests.test_push_policy::test_an_operation_present_in_the_base_inventory_is_not_new": "passed", + "tests.test_push_policy::test_an_unenumerated_base_scope_stays_unresolved": "passed", + "tests.test_push_policy::test_any_other_transaction_context_gap_still_blocks": "passed", + "tests.test_push_policy::test_benign_identifier_rename_is_unknown_not_new": "passed", + "tests.test_push_policy::test_changed_line_novelty_still_requires_a_complete_base": "passed", + "tests.test_push_policy::test_changed_new_operation_in_comparable_existing_file": "passed", + "tests.test_push_policy::test_changed_source_text_needs_identity_proof_not_a_rename_guess": "passed", + "tests.test_push_policy::test_comparison_cache_reuses_only_completed_compatible_evidence": "passed", + "tests.test_push_policy::test_deadline_exhaustion_prevents_any_new_base_build": "passed", + "tests.test_push_policy::test_dependency_gaps_are_bound_to_the_candidate": "passed", + "tests.test_push_policy::test_discharged_or_unentailed_operation_on_a_changed_line_is_not_new": "passed", + "tests.test_push_policy::test_failed_truncated_incompatible_base_remains_unknown": "passed", + "tests.test_push_policy::test_head_failure_or_unproven_witness_stays_unknown": "passed", + "tests.test_push_policy::test_incomplete_counterpart_still_blocks": "passed", + "tests.test_push_policy::test_inventory_rows_do_not_count_as_unparsed_answer_body": "passed", + "tests.test_push_policy::test_missing_anchor_and_ambiguous_witness_do_not_invent_novelty": "passed", + "tests.test_push_policy::test_moved_identical_operation_on_a_changed_line_is_not_new": "passed", + "tests.test_push_policy::test_new_source_at_unchanged_operation_needs_complete_base_answer": "passed", + "tests.test_push_policy::test_non_string_operation_cannot_prove_base_absence": "passed", + "tests.test_push_policy::test_operation_introduced_on_a_changed_line_is_new_against_a_complete_base": "passed", + "tests.test_push_policy::test_operation_outside_any_recorded_head_span_is_not_new": "passed", + "tests.test_push_policy::test_other_completed_question_cannot_prove_absence_for_missing_counterpart": "passed", + "tests.test_push_policy::test_proven_tier_zero_other_families_do_not_invalidate_base_answer": "passed", + "tests.test_push_policy::test_removed_discharge_is_worsened_at_unchanged_sink": "passed", + "tests.test_push_policy::test_renamed_file_keeps_operation_identity_across_a_changed_line": "passed", + "tests.test_push_policy::test_repeated_unchanged_lines_do_not_invalidate_a_distinct_operation": "passed", + "tests.test_push_policy::test_string_false_is_not_supported_discharge_evidence": "passed", + "tests.test_push_policy::test_targeted_base_uses_real_driver_same_deadline": "passed", + "tests.test_push_policy::test_truncated_base_cannot_establish_absence_wherever_it_was_truncated": "passed", + "tests.test_push_policy::test_unchanged_backlog_and_renamed_movement_stay_unchanged": "passed", + "tests.test_push_policy::test_unknown_ownership_boundary_stays_inside_the_required_scope": "passed", + "tests.test_push_policy::test_unrelated_lexical_guard_removal_does_not_override_same_flow": "passed", + "tests.test_push_policy::test_unrelated_question_context_gap_does_not_poison_completed_comparison": "passed", + "tests.test_push_policy::test_unrelated_unsupported_family_no_longer_blocks_a_complete_target_comparison": "passed", + "tests.test_push_policy::test_wrong_query_mechanism_cannot_prove_base_absence": "passed", + "tests.test_push_regression_integration::test_failed_census_after_physical_vendor_filter_is_not_clean": "passed", + "tests.test_push_regression_integration::test_interrupted_writer_preserves_previous_artifact_and_reaps_child": "passed", + "tests.test_push_regression_integration::test_mixed_transaction_retains_exact_objects_and_external_boundaries": "passed", + "tests.test_push_report::test_complete_empty_check_is_bounded_by_scope": "passed", + "tests.test_push_report::test_display_cap_preserves_all_decisions_and_complete_artifact": "passed", + "tests.test_push_report::test_expired_reporting_allowance_still_returns_real_decision": "passed", + "tests.test_push_report::test_failed_base_evidence_cannot_be_presented_as_complete": "passed", + "tests.test_push_report::test_invalid_artifact_destination_is_a_notice_not_an_exception": "passed", + "tests.test_push_report::test_invalid_serializable_detail_fails_without_losing_decision": "passed", + "tests.test_push_report::test_long_terminal_values_are_bounded_but_artifact_keeps_full_evidence": "passed", + "tests.test_push_report::test_mismatched_result_or_missing_evidence_is_rejected": "passed", + "tests.test_push_report::test_one_incomplete_notice_and_one_status_without_claiming_secure": "passed", + "tests.test_push_report::test_provenance_and_timings_are_frozen_after_construction": "passed", + "tests.test_push_report::test_repository_control_characters_cannot_inject_terminal_notices": "passed", + "tests.test_push_report::test_stalled_writer_is_cancelled_without_overwriting_previous_artifact": "passed", + "tests.test_push_report::test_unavailable_and_not_applicable_never_read_as_completed": "passed", + "tests.test_push_report::test_write_failure_retains_existing_artifact_and_block_decision": "passed", + "tests.test_push_report::test_writer_exiting_zero_without_receipt_is_not_success": "passed", + "tests.test_push_reuse::test_backend_reuses_graph_and_answers_then_invalidates_source_and_dependencies": "passed", + "tests.test_push_reuse::test_fresh_missing_census_cannot_borrow_a_cached_query_census": "passed", + "tests.test_push_reuse::test_the_single_attempt_path_is_reused_and_normalized_too": "passed", + "tests.test_push_runner::test_admission_provenance_invalidates_when_installed_runtime_changes": "passed", + "tests.test_push_runner::test_base_failure_retains_completed_head_evidence": "passed", + "tests.test_push_runner::test_cache_cannot_write_inside_repository": "passed", + "tests.test_push_runner::test_cached_discovery_invalidates_source_and_dependency_edits": "passed", + "tests.test_push_runner::test_cli_exposes_replay": "passed", + "tests.test_push_runner::test_default_replay_does_not_launch_unbudgeted_availability_probe": "passed", + "tests.test_push_runner::test_expired_preparation_obeys_total_deadline": "passed", + "tests.test_push_runner::test_hanging_discovery_is_bounded": "passed", + "tests.test_push_runner::test_identical_revision_materializes_once_and_reuses_discovery": "passed", + "tests.test_push_runner::test_missing_revision_is_unavailable_not_clean": "passed", + "tests.test_push_runner::test_preparation_exit_zero_without_receipt_is_failure": "passed", + "tests.test_push_runner::test_preparation_large_result_does_not_deadlock": "passed", + "tests.test_push_runner::test_replay_artifact_cannot_overwrite_live_repository": "passed", + "tests.test_push_runner::test_replay_persists_discovery_without_skipping_readable_snapshots": "passed", + "tests.test_push_runner::test_replay_unavailable_preserves_input_and_records_scope": "passed", + "tests.test_push_runner::test_snapshot_boundaries_reach_engine_change_context": "passed", + "tests.test_push_runner::test_snapshot_resolution_uses_shared_deadline": "passed", + "tests.test_push_runner::test_strict_incomplete_policy_and_artifact_failure": "passed", + "tests.test_push_scoring::test_actionable_recall_requires_reviewed_alert_beside_detection": "passed", + "tests.test_push_scoring::test_actual_execution_context_must_match[budget_seconds]": "passed", + "tests.test_push_scoring::test_actual_execution_context_must_match[engine]": "passed", + "tests.test_push_scoring::test_actual_execution_context_must_match[facts]": "passed", + "tests.test_push_scoring::test_actual_execution_context_must_match[queries]": "passed", + "tests.test_push_scoring::test_actual_execution_context_must_match[scope]": "passed", + "tests.test_push_scoring::test_deferred_questions_and_unmeasured_cases_remain_coverage_limits": "passed", + "tests.test_push_scoring::test_evidence_launch_failure_retains_unresolved_population": "passed", + "tests.test_push_scoring::test_fixed_negative_needs_completed_answer_benign_backlog_is_not_alert": "passed", + "tests.test_push_scoring::test_missing_and_failed_keep_positive_denominator": "passed", + "tests.test_push_scoring::test_missing_source_overrides_an_asserted_positive": "passed", + "tests.test_push_scoring::test_positive_requires_answered_exact_target_witness[empty_witness]": "passed", + "tests.test_push_scoring::test_positive_requires_answered_exact_target_witness[unanswered]": "passed", + "tests.test_push_scoring::test_positive_requires_answered_exact_target_witness[unselected]": "passed", + "tests.test_push_scoring::test_positive_requires_answered_exact_target_witness[wrong_family]": "passed", + "tests.test_push_scoring::test_positive_requires_answered_exact_target_witness[wrong_site]": "passed", + "tests.test_push_scoring::test_profiles_cannot_be_swapped_or_mutated": "passed", + "tests.test_push_scoring::test_rank_absence_without_path_is_not_transitivity": "passed", + "tests.test_push_scoring::test_regression_readable_despite_missing_admission_prerequisite": "passed", + "tests.test_push_scoring::test_static_rank_never_claims_transitive_detection": "passed", + "tests.test_push_scoring::test_unmeasured_benign_is_not_perfect_interruption_rate": "passed", + "tests.test_push_scoring::test_unreviewed_wrong_target_alerts_remain_precision_denominator": "passed", + "tests.test_push_scoring::test_witnessed_positive_without_rank_is_counted": "passed", + "tests.test_push_snapshot::test_bad_protocol_never_silently_skips_lines[sha1]": "passed", + "tests.test_push_snapshot::test_bad_protocol_never_silently_skips_lines[sha256]": "passed", + "tests.test_push_snapshot::test_change_context_ambiguous_identical_file_renames_preserve_gap[sha1]": "passed", + "tests.test_push_snapshot::test_change_context_ambiguous_identical_file_renames_preserve_gap[sha256]": "passed", + "tests.test_push_snapshot::test_change_context_function_rename_and_removed_guard[sha1-js-- requirePermission(user);\\n- execute(input);\\n]": "passed", + "tests.test_push_snapshot::test_change_context_function_rename_and_removed_guard[sha1-php- Path: + (path / "scan").mkdir(parents=True) + (path / "suite.json").write_text(equality.dump(suite)) + (path / "scan" / "findings.json").write_text(equality.dump(findings)) + (path / "scan" / "stdout.txt").write_text(stdout) + (path / "env.json").write_text(json.dumps({"tree_ish": str(path)})) + return path + + +def _normalized(raw: dict[str, object], root: str) -> object: + return equality.normalize(raw, root, "/tmp/x") + + +def test_excluded_fields_and_run_ids_do_not_count(tmp_path: Path) -> None: + a = _normalized({"rule": "sqli", "runtime_seconds": 1.2, "path": "/r1/runs/20260930T101010Z-0123abcd/f.py", "t_ms": 4}, "/r1") + b = _normalized({"rule": "sqli", "runtime_seconds": 9.9, "path": "/r2/runs/20261001T111111Z-ffffffff/f.py", "t_ms": 7}, "/r2") + suite = {"tests.test_x::test_a": "passed"} + diffs = equality.compare(_record(tmp_path / "a", findings=a, suite=suite), _record(tmp_path / "b", findings=b, suite=suite), {}) + assert diffs == [] + + +def test_a_changed_finding_is_reported_with_its_key(tmp_path: Path) -> None: + suite = {"tests.test_x::test_a": "passed"} + a = _record(tmp_path / "a", findings=[{"rule": "sqli", "line": 3}], suite=suite) + b = _record(tmp_path / "b", findings=[{"rule": "sqli", "line": 4}], suite=suite) + assert equality.compare(a, b, {}) == ["scan/findings.json: $[0].line: 3 -> 4"] + assert equality.main(["compare", str(a), str(b)]) == 1 + + +def test_a_changed_outcome_or_unmapped_test_is_reported(tmp_path: Path) -> None: + a = _record(tmp_path / "a", findings=[], suite={"t::a": "passed", "t::gone": "passed", "t::old": "skipped"}) + b = _record(tmp_path / "b", findings=[], suite={"t::a": "failure", "t::new": "skipped", "t::extra": "passed"}, stdout="findings=2\n") + diffs = equality.compare(a, b, {"deleted": ["t::gone"], "renamed": {"t::old": "t::new"}}) + assert diffs == [ + "suite.json: t::a passed -> failure", + "suite.json: t::extra new in candidate", + "scan/stdout.txt: first differing line 1: 'findings=3' -> 'findings=2'", + ] + + +def test_a_file_present_on_one_side_only_is_reported(tmp_path: Path) -> None: + a = _record(tmp_path / "a", findings=[], suite={}) + b = _record(tmp_path / "b", findings=[], suite={}) + (b / "scan" / "fusion.json").write_text("[]\n") + assert equality.compare(a, b, {}) == ["scan/fusion.json: present only in candidate"]