mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Marius CiepluchandClaude Fable 5.1
b1c5f36076
Tasks 8.1, 7.1 (tests) and the re-scoped 5.3.
- pairs.py: review_tier in {seeded, advisory, title, reviewed} with
per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/
github advisory, agent-vfc title); reviewer = "pending" means title, a
named reviewer means reviewed, reviewed without a reviewer is rejected;
per_tier metrics in the payload; select_tier and GATING_TIERS for the
improve loop.
- catalog_gen.py: stamps review_tier (and reviewer) on every generated
row and training manifest row; title rows enter catalog.toml; the
catalog-candidates.toml queue is retired; precedence matches the loader.
- agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the
honest unreviewed baseline); local rows name their reviewer.
- Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1
catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
vfc-js slice
Server-side JavaScript function pairs harvested from the upstream fix commits that
SecBench.js records in its package metadata
(fixCommit, sink). SecBench.js itself has no license file, so none of its files are vendored;
each excerpt carries the upstream package's license.
- Classes: command injection, path traversal, code injection first. Prototype pollution and ReDoS
rows may be added with their own mechanism and
known_limituntil the engine can talk about them. - Mode:
hunk(the function enclosing the first changed hunk on each side). - Provenance:
human.
Rebuild: python benchmarks/pairs/vfc-js/build_recipes.py --crawl /tmp/secbench.jsonl then
--from /tmp/secbench.jsonl, harvest.py --slice vfc-js --all --fetch, catalog_gen.py --slice vfc-js.