{ "status": "measured", "version": "source-review-50-v1", "date": "2026-11-03", "fixtureOrigin": "https://warhound-source-benchmark-50.vercel.app", "fixtureDeployment": "dpl_GwomWMoode9qoQoPHYxYmjBytwxw", "model": "gemini-3.8-flash", "provider": "Google Cloud", "plan": "Plus", "mode": "Soft", "multiplier": 1, "thinkingLevel": "LOW", "batchCount": 6, "completedBatches": 6, "preflightFailures": 1, "preflightFailureReason": "Incomplete provider response; exact finish reason was not retained.", "quotaInterruptedAttempts": 1, "operatorAllowanceRefreshes": 1, "zeroTokenPartialRecoveryVerified": true, "weightedTokens": 139071, "preflightWeightedTokens": 22604, "quotaInterruptedWeightedTokens": 10494, "allAttemptsWeightedTokens": 172169, "minBatchSeconds": 38.79, "maxBatchSeconds": 94.43, "medianBatchSeconds": 61.01, "datasetSha256": "d4994053dabd5339da28bf798ffc45401b56bcf71e940ce0c874ef86e8c3d56c", "metrics": { "detected": 49, "missed": 1, "inconclusive": 0, "falsePositives": 0, "correctControls": 10, "unscoredControls": 0, "differentWarningOnMissedSeed": 1 }, "scoring": "AI-assisted WarHound review of root-cause explanation and exact source evidence; CWE labels can differ. A different warning alone does not match the seed. Not an independent audit.", "attemptPolicy": "First complete verdict per case. The final batch reran only because the prior response was incomplete. No accuracy-based reruns or best-answer selection.", "limits": "Inert synthetic source snippets on 60 mini-app pages under one origin, reviewed in 6 source bundles. No executable vulnerable backend, active exploit validation, full-site crawl, general accuracy claim or other-model security score. Normal Plus limits enforced; one audited internal five-hour allowance refresh finished the last batch.", "batches": [ { "batch": 1, "apps": 10, "model": "gemini-3.8-flash", "elapsedSeconds": 64.07, "weightedTokens": 20896, "tools": [ "scrape_website", "record_candidate_findings" ] }, { "batch": 2, "apps": 10, "model": "gemini-3.8-flash", "elapsedSeconds": 53.26, "weightedTokens": 22662, "tools": [ "scrape_website", "record_candidate_findings" ] }, { "batch": 3, "apps": 10, "model": "gemini-3.8-flash", "elapsedSeconds": 57.95, "weightedTokens": 25849, "tools": [ "scrape_website", "record_candidate_findings" ] }, { "batch": 4, "apps": 10, "model": "gemini-3.8-flash", "elapsedSeconds": 38.79, "weightedTokens": 17474, "tools": [ "scrape_website", "record_candidate_findings" ] }, { "batch": 5, "apps": 10, "model": "gemini-3.8-flash", "elapsedSeconds": 94.43, "weightedTokens": 26913, "tools": [ "scrape_website", "record_candidate_findings" ] }, { "batch": 6, "apps": 10, "model": "gemini-3.8-flash", "elapsedSeconds": 71.72, "weightedTokens": 25277, "tools": [ "scrape_website", "record_candidate_findings" ] } ], "cases": [ { "id": "098778bd", "path": "/apps/098778bd/", "sourcePath": "/apps/098778bd/source.txt", "positive": true, "expected": "Hardcoded signing secret", "referenceCwe": "CWE-798", "modelCwe": "CWE-798", "modelDecision": "issue", "modelReason": "Hardcoded secret string is used to sign JWT authentication tokens, allowing offline forgery.", "modelExcerpt": "const SIGNING_SECRET='development-auth-secret';app.post('/login',authenticate,(req,res)=>res.json({token:jwt.sign({sub:req.user.id},SIGNING_SECRET)}));", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "b35f8d7db89639f6d5e66b4f50f9cd425ab95e4d6aaaa0a754220abf89f565a0" }, { "id": "ee36bb6f", "path": "/apps/ee36bb6f/", "sourcePath": "/apps/ee36bb6f/source.txt", "positive": true, "expected": "Credentialed reflected CORS", "referenceCwe": "CWE-942", "modelCwe": "CWE-942", "modelDecision": "issue", "modelReason": "CORS configuration dynamically reflects arbitrary Origin headers while allowing credentials.", "modelExcerpt": "app.use((req,res,next)=>{res.set('Access-Control-Allow-Origin',req.headers.origin);res.set('Access-Control-Allow-Credentials','true');next();});", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "f96a676b089b2d71440727bed65dc342de904ea94edac46e3e5b1cf101f2e21a" }, { "id": "a4196a6d", "path": "/apps/a4196a6d/", "sourcePath": "/apps/a4196a6d/source.txt", "positive": true, "expected": "Account enumeration", "referenceCwe": "CWE-204", "modelCwe": "CWE-204", "modelDecision": "issue", "modelReason": "Returns 404 on missing users, allowing attackers to enumerate registered email addresses.", "modelExcerpt": "if(!u)return res.status(404).send('No such account');sendReset(u);res.send('Reset sent');", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "656f52fa0095b388f6f008df94646e7c02371ac149ef7eaa6717a6ee9011006b" }, { "id": "0a213395", "path": "/apps/0a213395/", "sourcePath": "/apps/0a213395/source.txt", "positive": false, "expected": "No wildcard token transmission", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "postMessage specifies a strict, trusted target origin parameter instead of a wildcard.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 1, "sourceSha256": "000f459e27661d2924fd3f95a1ee64ff6d3ef76f61ca7567f64d302867e09ca8" }, { "id": "edfd24b6", "path": "/apps/edfd24b6/", "sourcePath": "/apps/edfd24b6/source.txt", "positive": false, "expected": "Strict message origin and safe sink", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Message event listener validates origin against an approved domain and assigns plain text safely.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 1, "sourceSha256": "e156e08539fb9dc392422a935b3d8e5a48db32dbe48faff6e24caa6971ef7e1f" }, { "id": "ce51c574", "path": "/apps/ce51c574/", "sourcePath": "/apps/ce51c574/source.txt", "positive": true, "expected": "Server code injection", "referenceCwe": "CWE-95", "modelCwe": "CWE-95", "modelDecision": "issue", "modelReason": "Untrusted request body expression is passed directly to eval(), permitting remote code execution.", "modelExcerpt": "app.post('/calculate',(req,res)=>res.json({answer:eval(req.body.expression)}));", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "03ff4ba9bd9af115678a142b84353775d7463c587a9fa50bc1d029758ccc09bd" }, { "id": "41751142", "path": "/apps/41751142/", "sourcePath": "/apps/41751142/source.txt", "positive": true, "expected": "JavaScript URL injection", "referenceCwe": "CWE-79", "modelCwe": "CWE-601", "modelDecision": "issue", "modelReason": "Unsanitized query parameter is written to href, enabling open redirects and javascript URI execution.", "modelExcerpt": "document.querySelector('#continue').href=new URLSearchParams(location.search).get('next');", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "d73878cf292a9e120e370f3d74fe2aefe68a32048d5f9dde2e0ed2a4ff54bd9a" }, { "id": "70363f8c", "path": "/apps/70363f8c/", "sourcePath": "/apps/70363f8c/source.txt", "positive": true, "expected": "TLS certificate verification disabled", "referenceCwe": "CWE-295", "modelCwe": "CWE-295", "modelDecision": "issue", "modelReason": "HTTPS agent explicitly sets rejectUnauthorized to false, disabling TLS certificate verification.", "modelExcerpt": "const agent=new https.Agent({rejectUnauthorized:false});https.get('https://payments.example.com/balance',{agent},handleBalance);", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "94daf05c4fdd72b8e71737a74167ab2b072097e498e8f89ca6890d6d0a4ddb97" }, { "id": "3e1163a7", "path": "/apps/3e1163a7/", "sourcePath": "/apps/3e1163a7/source.txt", "positive": true, "expected": "Zip path traversal", "referenceCwe": "CWE-22", "modelCwe": "CWE-22", "modelDecision": "issue", "modelReason": "Archive entry names are joined to destination path without traversal validation, allowing Zip Slip overwrites.", "modelExcerpt": "for(const entry of uploadedZip.entries){fs.writeFileSync(path.join('/srv/unpacked',entry.name),entry.bytes);}", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "63cb0199f68d8c045ad41686535046930abb66ed883c815d5f69d8c2450a97fd" }, { "id": "468a3468", "path": "/apps/468a3468/", "sourcePath": "/apps/468a3468/source.txt", "positive": true, "expected": "Predictable password reset", "referenceCwe": "CWE-330", "modelCwe": "CWE-338", "modelDecision": "issue", "modelReason": "Uses cryptographically weak Math.random() to generate sensitive password reset tokens.", "modelExcerpt": "const token=Math.random().toString(36).slice(2);resetTokens.set(token,{userId:user.id,expires:Date.now()+3600000});sendResetEmail(user,token);", "excerptMatchesSource": true, "grade": "Detected", "batch": 1, "sourceSha256": "7df4d1777eb2da49870dae33d8bea2223ac625f36edd9c1b241402ff0830dcec" }, { "id": "c3bcebf3", "path": "/apps/c3bcebf3/", "sourcePath": "/apps/c3bcebf3/source.txt", "positive": true, "expected": "Plaintext password storage", "referenceCwe": "CWE-256", "modelCwe": "CWE-312", "modelDecision": "issue", "modelReason": "The registration handler stores user passwords directly in cleartext in the database without cryptographic hashing.", "modelExcerpt": "await users.insert({email:req.body.email,password:req.body.password});", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "25fa30b3f983b305b728db6174b1e346cb5f704dc5c4880ac6a13813f87267bd" }, { "id": "c5717c9f", "path": "/apps/c5717c9f/", "sourcePath": "/apps/c5717c9f/source.txt", "positive": true, "expected": "Path traversal", "referenceCwe": "CWE-22", "modelCwe": "CWE-22", "modelDecision": "issue", "modelReason": "Untrusted query parameter file is directly appended to the file path in res.sendFile, allowing path traversal.", "modelExcerpt": "res.sendFile('/srv/private/reports/'+req.query.file)", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "dd4e8e382a307b64e28feaa5ed8ab7dd495991abb32d2c76aa677af1bd59c163" }, { "id": "9d10ebc0", "path": "/apps/9d10ebc0/", "sourcePath": "/apps/9d10ebc0/source.txt", "positive": true, "expected": "Explicit login rate-limit bypass", "referenceCwe": "CWE-307", "modelCwe": "CWE-307", "modelDecision": "issue", "modelReason": "Rate limiting on the login route is completely bypassed because the skip handler is hardcoded to return true.", "modelExcerpt": "rateLimit({windowMs:60000,max:5,skip:()=>true})", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "768e93c8433fa2dfc3ef9db8090e9e3f90006c7e5b43618b7f26a2468eb4a43e" }, { "id": "75e4d632", "path": "/apps/75e4d632/", "sourcePath": "/apps/75e4d632/source.txt", "positive": true, "expected": "NoSQL operator injection", "referenceCwe": "CWE-943", "modelCwe": "CWE-943", "modelDecision": "issue", "modelReason": "JSON body values are passed directly into the database query predicate, enabling NoSQL operator injection authentication bypass.", "modelExcerpt": "users.findOne({email:req.body.email,password:req.body.password})", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "ea6836fe8d7a3d70fb377b64df8077f1a22484e2f379f1f22c3ceb7e817aa2cc" }, { "id": "cee514ee", "path": "/apps/cee514ee/", "sourcePath": "/apps/cee514ee/source.txt", "positive": true, "expected": "Private profile IDOR", "referenceCwe": "CWE-639", "modelCwe": "CWE-639", "modelDecision": "issue", "modelReason": "Endpoint enforces authentication but fails to verify that the logged-in user is authorized to view the requested profile ID.", "modelExcerpt": "app.get('/private/profile/:id',loginRequired,async(req,res)=>res.json(await users.privateProfile(req.params.id)));", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "62fa83d6ddbc46ecbf1192c53a5706cf2a87a78cebdca45d7f65b7ab7ddaafa0" }, { "id": "19423749", "path": "/apps/19423749/", "sourcePath": "/apps/19423749/source.txt", "positive": true, "expected": "DOM XSS from URL", "referenceCwe": "CWE-79", "modelCwe": "CWE-79", "modelDecision": "issue", "modelReason": "The query parameter q is assigned directly into the DOM innerHTML sink, leading to client-side DOM XSS.", "modelExcerpt": "document.querySelector('#result').innerHTML=new URLSearchParams(location.search).get('q');", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "2587e57d868cac50a5e94761b5de3e314a18aa1bc00016bc5a785c1082b55bfa" }, { "id": "2c9d7cfb", "path": "/apps/2c9d7cfb/", "sourcePath": "/apps/2c9d7cfb/source.txt", "positive": true, "expected": "Bearer secret in URL", "referenceCwe": "CWE-598", "modelCwe": "CWE-598", "modelDecision": "issue", "modelReason": "The access token credential is passed via a URL query parameter, exposing it in browser history and server logs.", "modelExcerpt": "const url='https://api.example.com/export?access_token='+session.accessToken;location.href=url;", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "be1016a2c5063683ca291c4efedba34bec65b24ddb7723461316ff5d0b4e2215" }, { "id": "113d32b4", "path": "/apps/113d32b4/", "sourcePath": "/apps/113d32b4/source.txt", "positive": true, "expected": "State-changing GET / CSRF", "referenceCwe": "CWE-352", "modelCwe": "CWE-352", "modelDecision": "issue", "modelReason": "State-changing transfer operation is exposed via a GET endpoint with ambient cookie authentication and no CSRF protection.", "modelExcerpt": "app.get('/transfer',cookieLogin,async(req,res)=>{await bank.transfer(req.user.id,req.query.to,req.query.amount);res.send('Sent');});", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "601268079186e58dd2ce658d380f36ff63998ad277de57d76174d73b2393c6ea" }, { "id": "9b2a7b48", "path": "/apps/9b2a7b48/", "sourcePath": "/apps/9b2a7b48/source.txt", "positive": true, "expected": "Unsafe markdown HTML", "referenceCwe": "CWE-79", "modelCwe": "CWE-79", "modelDecision": "issue", "modelReason": "User-supplied markdown is parsed with sanitization explicitly disabled and served as HTML, permitting cross-site scripting.", "modelExcerpt": "marked.parse(req.body.markdown,{sanitize:false})", "excerptMatchesSource": true, "grade": "Detected", "batch": 2, "sourceSha256": "ec1933cbb8eb2e4455115cea636beda64122eb9db3dec9f4473e532e8cab0922" }, { "id": "cd86f08d", "path": "/apps/cd86f08d/", "sourcePath": "/apps/cd86f08d/source.txt", "positive": false, "expected": "Explicit authentication throttling", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Rate limiting middleware is appropriately applied to the login endpoint without any bypass flags or misconfigurations.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 2, "sourceSha256": "e90f3a18df46df9a9c4fe3175e22643f2f849750cc9cd7d124da85d669868bb7" }, { "id": "17c47ccb", "path": "/apps/17c47ccb/", "sourcePath": "/apps/17c47ccb/source.txt", "positive": true, "expected": "Untrusted pickle deserialization", "referenceCwe": "CWE-502", "modelCwe": "CWE-502", "modelDecision": "issue", "modelReason": "Deserializes untrusted request data using Python pickle, enabling arbitrary code execution.", "modelExcerpt": "value=pickle.loads(base64.b64decode(request.json['data']))", "excerptMatchesSource": true, "grade": "Detected", "batch": 3, "sourceSha256": "ed3a9a5b0d80b228d4b3f8f5d18ce4a61c76d8297b74c869ab80ffa218b55217" }, { "id": "2dad7f44", "path": "/apps/2dad7f44/", "sourcePath": "/apps/2dad7f44/source.txt", "positive": true, "expected": "SQL injection", "referenceCwe": "CWE-89", "modelCwe": "CWE-89", "modelDecision": "issue", "modelReason": "Directly concatenates untrusted query parameter into SQL statement string, allowing SQL injection.", "modelExcerpt": "db.query(\"SELECT * FROM orders WHERE name='\"+req.query.name+\"'\")", "excerptMatchesSource": true, "grade": "Detected", "batch": 3, "sourceSha256": "edbd9b3b71654b7092db0928bf6d9fabcd7767e3554052c1350e79271eff248e" }, { "id": "0158a4d3", "path": "/apps/0158a4d3/", "sourcePath": "/apps/0158a4d3/source.txt", "positive": false, "expected": "Argument-separated process call", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Safely executes binary using execFile with arguments array and shell execution disabled.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 3, "sourceSha256": "6f4e7b332139e93631921fd4618bc1fa590f0006b6355076a901245c1491d97c" }, { "id": "5c675dfa", "path": "/apps/5c675dfa/", "sourcePath": "/apps/5c675dfa/source.txt", "positive": false, "expected": "Text-only DOM output", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Safely assigns URL parameter value to textContent instead of innerHTML, preventing XSS.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 3, "sourceSha256": "97d11747d259b256c9baec37ae2f5a78e404299cc2706599ed46d0fc8a0bd89c" }, { "id": "f4844c1a", "path": "/apps/f4844c1a/", "sourcePath": "/apps/f4844c1a/source.txt", "positive": true, "expected": "Unbounded decompression", "referenceCwe": "CWE-409", "modelCwe": "CWE-409", "modelDecision": "issue", "modelReason": "Synchronously decompresses untrusted input with a 1GB limit, creating denial of service via decompression bomb.", "modelExcerpt": "app.post('/import',express.raw({limit:'1gb'}),(req,res)=>{const data=zlib.gunzipSync(req.body);res.send(data);});", "excerptMatchesSource": true, "grade": "Detected", "batch": 3, "sourceSha256": "567e45a06e72670340563ee1c23828e68f053addbbe833435214ffd21a55df18" }, { "id": "27d244ba", "path": "/apps/27d244ba/", "sourcePath": "/apps/27d244ba/source.txt", "positive": true, "expected": "Stored XSS", "referenceCwe": "CWE-79", "modelCwe": "CWE-79", "modelDecision": "issue", "modelReason": "Concatenates unescaped database comment bodies directly into an HTML response, leading to stored XSS.", "modelExcerpt": "(await db.comments.find()).map(c=>'

'+c.body+'

').join('')", "excerptMatchesSource": true, "grade": "Detected", "batch": 3, "sourceSha256": "d89e70ef1250aaf14daec339e3b964b049e504a873a42c06e42372c132a28e04" }, { "id": "38b2bcdf", "path": "/apps/38b2bcdf/", "sourcePath": "/apps/38b2bcdf/source.txt", "positive": true, "expected": "Executable-content upload", "referenceCwe": "CWE-434", "modelCwe": "CWE-22", "modelDecision": "issue", "modelReason": "Uses client-controlled originalname directly in destination path during rename, enabling path traversal file overwrite.", "modelExcerpt": "fs.renameSync(req.file.path,'public/uploads/'+req.file.originalname);", "excerptMatchesSource": true, "grade": "Missed seed", "batch": 3, "sourceSha256": "ead1a40c0132701ec93786dacef4b929c9ec277aa5720527e17974a72f47e668", "adjudication": "The model reported path traversal, not the seeded executable-content upload risk. The seed is counted as missed." }, { "id": "0fe6b6ec", "path": "/apps/0fe6b6ec/", "sourcePath": "/apps/0fe6b6ec/source.txt", "positive": true, "expected": "Unsafe iframe srcdoc", "referenceCwe": "CWE-79", "modelCwe": "CWE-79", "modelDecision": "issue", "modelReason": "Assigns unvalidated URL parameter directly to iframe srcdoc without sandboxing, enabling DOM-based XSS.", "modelExcerpt": "view.srcdoc=new URLSearchParams(location.search).get('preview');", "excerptMatchesSource": true, "grade": "Detected", "batch": 3, "sourceSha256": "6dfb244e58a255a18060d1d3cae6df122e04edba09e26d586cceaf93d94ff2e7" }, { "id": "28b37643", "path": "/apps/28b37643/", "sourcePath": "/apps/28b37643/source.txt", "positive": true, "expected": "Untrusted document becomes system instruction", "referenceCwe": "CWE-1427", "modelCwe": "CWE-918", "modelDecision": "issue", "modelReason": "Fetches arbitrary user-provided URL and injects untrusted web content into system prompt with tool execution access.", "modelExcerpt": "const page=await fetch(userUrl).then(r=>r.text());const answer=await llm.chat({messages:[{role:'system',content:page},{role:'user',content:question}],tools:privateAccountTools});", "excerptMatchesSource": true, "grade": "Detected", "batch": 3, "sourceSha256": "b5f0d18029c96c6917315284c76bdec6203fc8dfdcee4ca1df6495809c0ea7e1" }, { "id": "3edc1833", "path": "/apps/3edc1833/", "sourcePath": "/apps/3edc1833/source.txt", "positive": false, "expected": "Parameterized SQL", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Uses parameterized SQL query with bind parameters, properly preventing SQL injection.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 3, "sourceSha256": "3c97e4d5497bb00979f0c42cd25d629bf4825a2b27972c54feb0bb65a42fe21b" }, { "id": "c5e81e4d", "path": "/apps/c5e81e4d/", "sourcePath": "/apps/c5e81e4d/source.txt", "positive": true, "expected": "Logout leaves server session active", "referenceCwe": "CWE-613", "modelCwe": "CWE-613", "modelDecision": "issue", "modelReason": "Logout clears cookie on client but fails to invalidate or remove session on server-side map.", "modelExcerpt": "app.post('/logout',(req,res)=>{res.clearCookie('sid');res.sendStatus(204);});", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "7fa8898479ff6a01f5c5f0579b56ab880ddd1879c5b84bb1aa56b7a8215aefa8" }, { "id": "cf4e0c08", "path": "/apps/cf4e0c08/", "sourcePath": "/apps/cf4e0c08/source.txt", "positive": true, "expected": "Open redirect", "referenceCwe": "CWE-601", "modelCwe": "CWE-601", "modelDecision": "issue", "modelReason": "Handler redirects directly to unvalidated user-controlled query parameter next, enabling open redirects.", "modelExcerpt": "app.get('/continue',(req,res)=>res.redirect(req.query.next));", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "700d0f5b3c499a20cb01496c56fc30b4d7b7bbb525af47034d26496e96821daa" }, { "id": "6f1ea1aa", "path": "/apps/6f1ea1aa/", "sourcePath": "/apps/6f1ea1aa/source.txt", "positive": false, "expected": "JWT signature validation", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Correctly verifies JWT signature using RS256 algorithm with explicit issuer and audience validation.", "modelExcerpt": "const claims=jwt.verify(token,publicKey,{algorithms:['RS256'],issuer:'https://issuer.example',audience:'demo'});", "excerptMatchesSource": true, "grade": "Correct control", "batch": 4, "sourceSha256": "ed4c59acf4b1d449ca155c1f725ee446d973146caf3e4017cbbc4c20606164e3" }, { "id": "78a65dca", "path": "/apps/78a65dca/", "sourcePath": "/apps/78a65dca/source.txt", "positive": true, "expected": "Session fixation", "referenceCwe": "CWE-384", "modelCwe": "CWE-384", "modelDecision": "issue", "modelReason": "Assigns user session using caller-provided cookie sid without rotating it upon authentication, permitting session fixation.", "modelExcerpt": "sessions[req.cookies.sid]={userId:req.user.id};", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "4c517146b97bdc9d86a32f125219a479948e1f13edc72d64753ca1cae64a8888" }, { "id": "98ae7405", "path": "/apps/98ae7405/", "sourcePath": "/apps/98ae7405/source.txt", "positive": true, "expected": "XML external entities enabled", "referenceCwe": "CWE-611", "modelCwe": "CWE-611", "modelDecision": "issue", "modelReason": "Parses XML with noent set to true, allowing XML external entity expansion.", "modelExcerpt": "const doc=libxmljs.parseXml(req.body.xml,{noent:true,nonet:false});", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "07c88d4dcd7e59adbff58746d418cf4c367f148d46af423cf7d57e18225441ee" }, { "id": "7a8199a8", "path": "/apps/7a8199a8/", "sourcePath": "/apps/7a8199a8/source.txt", "positive": true, "expected": "Unverified JWT claims", "referenceCwe": "CWE-347", "modelCwe": "CWE-345", "modelDecision": "issue", "modelReason": "Authorizes administrative access using unverified decoded JWT claims rather than cryptographically verifying the token.", "modelExcerpt": "const claims=jwt.decode(req.cookies.token);if(claims.role==='admin')res.json(privateRecords)", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "bd8d804f42c92387b5e909eab5fa1ecf1c80c19fafbebf88bb570150b176128f" }, { "id": "f6cf48e6", "path": "/apps/f6cf48e6/", "sourcePath": "/apps/f6cf48e6/source.txt", "positive": false, "expected": "Strong password hashing", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "Properly hashes user password using modern Argon2id algorithm prior to storage.", "modelExcerpt": "const passwordHash=await argon2.hash(req.body.password,{type:argon2.argon2id});", "excerptMatchesSource": true, "grade": "Correct control", "batch": 4, "sourceSha256": "176b5d78ddf0ef0c2bba2eb22050fce042c43a6b08ae6c35b4886581d666913b" }, { "id": "d3f83896", "path": "/apps/d3f83896/", "sourcePath": "/apps/d3f83896/source.txt", "positive": true, "expected": "SSRF", "referenceCwe": "CWE-918", "modelCwe": "CWE-918", "modelDecision": "issue", "modelReason": "Fetches untrusted user-supplied URL directly without validation or network restrictions, allowing server-side request forgery.", "modelExcerpt": "app.get('/fetch',async(req,res)=>res.send(await (await fetch(req.query.url)).text()));", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "296dfc3cb13381143bbecb64bfd72bd6dae48bc7da7e336129729f4ba70867e5" }, { "id": "01cb88ba", "path": "/apps/01cb88ba/", "sourcePath": "/apps/01cb88ba/source.txt", "positive": true, "expected": "Fast unsalted password hash", "referenceCwe": "CWE-916", "modelCwe": "CWE-328", "modelDecision": "issue", "modelReason": "Stores user password using weak, collision-prone, and unsalted MD5 hash.", "modelExcerpt": "const storedPassword=crypto.createHash('md5').update(req.body.password).digest('hex');", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "8e974d5a18b186983dfb0d2442dc95507a37db53c47a12549e96282f69a1dd4f" }, { "id": "f76ddac0", "path": "/apps/f76ddac0/", "sourcePath": "/apps/f76ddac0/source.txt", "positive": true, "expected": "Unprotected admin deletion", "referenceCwe": "CWE-862", "modelCwe": "CWE-306", "modelDecision": "issue", "modelReason": "Administrative user deletion endpoint exposes privileged deletion functionality without authentication or authorization checks.", "modelExcerpt": "app.delete('/admin/users/:id',async(req,res)=>{await users.delete(req.params.id);res.sendStatus(204);});", "excerptMatchesSource": true, "grade": "Detected", "batch": 4, "sourceSha256": "815d575ea91c873e27f3f7e013988e26ef9c8810fdc0f4348f05c7847fd8f6ce" }, { "id": "fa0b3587", "path": "/apps/fa0b3587/", "sourcePath": "/apps/fa0b3587/source.txt", "positive": true, "expected": "Untrusted window message", "referenceCwe": "CWE-346", "modelCwe": "CWE-79", "modelDecision": "issue", "modelReason": "Unvalidated postMessage data is assigned directly to innerHTML, allowing client-side cross-site scripting.", "modelExcerpt": "window.addEventListener('message',event=>{document.querySelector('#message').innerHTML=event.data.html;});", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "9d11ba2ddfed53da6834eeec474833fa623ce95e4eff895cacedcb8ce1312368" }, { "id": "8c380a5d", "path": "/apps/8c380a5d/", "sourcePath": "/apps/8c380a5d/source.txt", "positive": true, "expected": "Prototype pollution", "referenceCwe": "CWE-1321", "modelCwe": "CWE-1321", "modelDecision": "issue", "modelReason": "Recursive object merge on unvalidated user JSON allows modification of Object prototype properties.", "modelExcerpt": "function merge(dst,src){for(const k of Object.keys(src)){if(src[k]&&typeof src[k]==='object')merge(dst[k]||(dst[k]={}),src[k]);else dst[k]=src[k];}}", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "7c8f0f5b1cf163773e892dbf01b52f8ab815faa401bda4d7f40d83c659484b32" }, { "id": "fa72da9a", "path": "/apps/fa72da9a/", "sourcePath": "/apps/fa72da9a/source.txt", "positive": true, "expected": "Cross-tenant report access", "referenceCwe": "CWE-863", "modelCwe": "CWE-639", "modelDecision": "issue", "modelReason": "Tenant-private reports are queried by user-controlled ID without validating tenant ownership or authorization.", "modelExcerpt": "app.get('/report/:id',loginRequired,async(req,res)=>res.json(await db.query('select * from reports where id=$1',[req.params.id])));", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "5a7de1adbdd9a340ec0c0c1cc27fa7bf1c498a504693289946d2b15de4c36ae2" }, { "id": "379a896b", "path": "/apps/379a896b/", "sourcePath": "/apps/379a896b/source.txt", "positive": false, "expected": "Safe JSON rendering", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "The endpoint safely returns a JSON-serialized object with appropriate JSON content type.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 5, "sourceSha256": "db46684e7ce8fd551befb62a7b7bea48a33f0cfb0ee0f3089e4482e244389655" }, { "id": "9a01e994", "path": "/apps/9a01e994/", "sourcePath": "/apps/9a01e994/source.txt", "positive": true, "expected": "OS command injection", "referenceCwe": "CWE-78", "modelCwe": "CWE-78", "modelDecision": "issue", "modelReason": "Unsanitized user-controlled query parameter is concatenated directly into a shell execution string.", "modelExcerpt": "app.get('/ping',(req,res)=>require('child_process').exec('ping -c 1 '+req.query.host,(e,out)=>res.send(out)));", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "e11433047d2b56ba07f8d215b3b4fe44d1cd6a32b56d6d6adf09ecc7f2528e0d" }, { "id": "95fd547f", "path": "/apps/95fd547f/", "sourcePath": "/apps/95fd547f/source.txt", "positive": true, "expected": "Template code injection", "referenceCwe": "CWE-1336", "modelCwe": "CWE-1336", "modelDecision": "issue", "modelReason": "Untrusted request body template is rendered directly with EJS, enabling server-side template injection.", "modelExcerpt": "app.post('/preview',(req,res)=>res.send(require('ejs').render(req.body.template,{name:req.user.name})));", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "f70417eef6a7428f7fa5d139c2f7826366dcce6965160d4e95572159898365c7" }, { "id": "ab52bc79", "path": "/apps/ab52bc79/", "sourcePath": "/apps/ab52bc79/source.txt", "positive": true, "expected": "Secret logging", "referenceCwe": "CWE-532", "modelCwe": "CWE-532", "modelDecision": "issue", "modelReason": "Sensitive cleartext API keys are logged directly to the console.", "modelExcerpt": "app.post('/connect',(req,res)=>{console.log('Connected using API key',req.body.apiKey);connect(req.body.apiKey);res.sendStatus(204);});", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "cadbd83afda9b740d5c596670f37c9e9abb09c83a06b14e1b7b260d9e5800fe6" }, { "id": "a6b91835", "path": "/apps/a6b91835/", "sourcePath": "/apps/a6b91835/source.txt", "positive": true, "expected": "User-controlled regular expression", "referenceCwe": "CWE-1333", "modelCwe": "CWE-1333", "modelDecision": "issue", "modelReason": "User input is directly compiled into a RegExp without validation, causing ReDoS risk.", "modelExcerpt": "app.get('/search',(req,res)=>{const re=new RegExp(req.query.pattern);res.json(records.filter(x=>re.test(x.text)));});", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "b0b8f6714f4d039f6d0346cdf534b9fb8a71397e23994c1023a73c7e03052d44" }, { "id": "9cb7f9ab", "path": "/apps/9cb7f9ab/", "sourcePath": "/apps/9cb7f9ab/source.txt", "positive": true, "expected": "AI tool lacks permission boundary", "referenceCwe": "CWE-862", "modelCwe": "CWE-862", "modelDecision": "issue", "modelReason": "Destructive customer deletion tool lacks tenant authorization checks before executing database record deletion.", "modelExcerpt": "agent.tools.deleteCustomerRecord=async({customerId})=>db.customers.delete(customerId);", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "ed46696b30fb251a11826be25d95208c24fdffd9c073af2d7814edb185063275" }, { "id": "e9e0e625", "path": "/apps/e9e0e625/", "sourcePath": "/apps/e9e0e625/source.txt", "positive": true, "expected": "Wildcard message discloses token", "referenceCwe": "CWE-200", "modelCwe": "CWE-200", "modelDecision": "issue", "modelReason": "Wildcard target origin in postMessage broadcasts sensitive access tokens to untrusted listening windows.", "modelExcerpt": "window.parent.postMessage({accessToken:session.accessToken},'*');", "excerptMatchesSource": true, "grade": "Detected", "batch": 5, "sourceSha256": "9c48a49c3ce75f9a02571c585eee4b0b09d6cbfe49d69b18cd97361da9bc7be9" }, { "id": "8ff8b794", "path": "/apps/8ff8b794/", "sourcePath": "/apps/8ff8b794/source.txt", "positive": true, "expected": "Readable insecure session cookie", "referenceCwe": "CWE-1004", "modelCwe": "CWE-1004", "modelDecision": "issue", "modelReason": "Session cookie explicitly disables httpOnly and secure flags, exposing the session token to client-side script theft and cleartext interception.", "modelExcerpt": "res.cookie('session',sessionToken,{httpOnly:false,secure:false,sameSite:'none'});", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "45587f99c1aabea94a2228e37d48d1e1ca140c68d3e240231b11bc4f74120654" }, { "id": "83572247", "path": "/apps/83572247/", "sourcePath": "/apps/83572247/source.txt", "positive": true, "expected": "Catastrophic regex backtracking", "referenceCwe": "CWE-1333", "modelCwe": "CWE-1333", "modelDecision": "issue", "modelReason": "The regular expression contains nested quantifiers evaluated against user input, leaving the endpoint susceptible to catastrophic backtracking and Denial of Service.", "modelExcerpt": "app.get('/validate',(req,res)=>res.json({ok:/^(a+)+$/.test(req.query.value)}));", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "0dcb61309b3d06856f01750c89eec3e598ffe3e93039a7e47bba775ddd550685" }, { "id": "0588066f", "path": "/apps/0588066f/", "sourcePath": "/apps/0588066f/source.txt", "positive": true, "expected": "Unsafe YAML object construction", "referenceCwe": "CWE-502", "modelCwe": "CWE-502", "modelDecision": "issue", "modelReason": "Untrusted request data is parsed using PyYAML's unsafe yaml.Loader, allowing arbitrary object instantiation and remote code execution.", "modelExcerpt": "return yaml.load(request.data, Loader=yaml.Loader)", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "c0e1b7b86fcd44775fa9ff1a23dc6e427b5cdf5a8d6c41162a5ce84947a96b19" }, { "id": "0ba54435", "path": "/apps/0ba54435/", "sourcePath": "/apps/0ba54435/source.txt", "positive": true, "expected": "Reset expiry ignored", "referenceCwe": "CWE-640", "modelCwe": "CWE-613", "modelDecision": "issue", "modelReason": "The password reset handler fails to verify the token expiration timestamp and does not invalidate the token after usage.", "modelExcerpt": "const row=resetTokens.get(req.body.token);if(!row)return res.sendStatus(400);await users.setPassword(row.userId,req.body.password);res.sendStatus(204);", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "0833a155946431d5b6228cb9e53c367922ac8b95ddc4d92d2b8cf84e5cc27e38" }, { "id": "27464ede", "path": "/apps/27464ede/", "sourcePath": "/apps/27464ede/source.txt", "positive": false, "expected": "Scoped private report query", "referenceCwe": null, "modelCwe": null, "modelDecision": "no_issue", "modelReason": "The handler enforces login and executes a parameterized SQL query scoped to the caller's tenantId.", "modelExcerpt": "", "excerptMatchesSource": false, "grade": "Correct control", "batch": 6, "sourceSha256": "7dd6be8485eb0bd1be32826e5576f946ffa48236ef0c5a596aa5239fb0c79414" }, { "id": "52acb21f", "path": "/apps/52acb21f/", "sourcePath": "/apps/52acb21f/source.txt", "positive": true, "expected": "Role mass assignment", "referenceCwe": "CWE-915", "modelCwe": "CWE-915", "modelDecision": "issue", "modelReason": "Directly passing the entire request body to the update function allows mass assignment, enabling users to modify protected properties such as isAdmin.", "modelExcerpt": "await users.update(req.user.id,req.body);", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "db732a1073a4c9bf14bd3269343230f2059bde88e262c6371683903b26aaccac" }, { "id": "b036c103", "path": "/apps/b036c103/", "sourcePath": "/apps/b036c103/source.txt", "positive": true, "expected": "Client-trusted price", "referenceCwe": "CWE-602", "modelCwe": "CWE-602", "modelDecision": "issue", "modelReason": "Payment amount is accepted directly from the client request body instead of being verified or calculated server-side.", "modelExcerpt": "app.post('/checkout',loginRequired,(req,res)=>payment.charge(req.user.card,req.body.priceCents));", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "6a3cb47cc2315cc5eaa440ddf61c500f37ffdb00d71ed8335c9a8dc9623a6ada" }, { "id": "c74656ff", "path": "/apps/c74656ff/", "sourcePath": "/apps/c74656ff/source.txt", "positive": true, "expected": "Unsigned JWT accepted", "referenceCwe": "CWE-347", "modelCwe": "CWE-347", "modelDecision": "issue", "modelReason": "JWT verification explicitly allows the 'none' algorithm with an empty secret, permitting signature forgery and authentication bypass.", "modelExcerpt": "const user=jwt.verify(req.cookies.token,'',{algorithms:['none']});", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "bc8d21dc6a7a14f051930c19b82d49c357c08569b6f13c0a095792f3c1ea3f18" }, { "id": "0b272520", "path": "/apps/0b272520/", "sourcePath": "/apps/0b272520/source.txt", "positive": true, "expected": "Reflected XSS", "referenceCwe": "CWE-79", "modelCwe": "CWE-79", "modelDecision": "issue", "modelReason": "Untrusted query parameter name is concatenated directly into HTML without output encoding, causing reflected cross-site scripting.", "modelExcerpt": "app.get('/hello',(req,res)=>res.type('html').send('

Hello '+req.query.name+'

'));", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "7395b60c3de2a84ab82d7a48031bb928afa21fa6df75d6a6884a305a4f466d17" }, { "id": "4d5fd7c9", "path": "/apps/4d5fd7c9/", "sourcePath": "/apps/4d5fd7c9/source.txt", "positive": true, "expected": "Unsafe temporary-file creation", "referenceCwe": "CWE-377", "modelCwe": "CWE-377", "modelDecision": "issue", "modelReason": "Using deprecated tempfile.mktemp introduces a time-of-check to time-of-use file race condition before the file is opened.", "modelExcerpt": "name=tempfile.mktemp(prefix='report-')\nwith open(name,'w') as output:", "excerptMatchesSource": true, "grade": "Detected", "batch": 6, "sourceSha256": "d24a746da3ef0848ac804a970faba7441011743c166fdc90e3cb95e75fc1fded" } ] }