Scanner deep-dive

DeepSeek V4 Flash by DeepSeek ↗

General-Purpose LLM · agentic-v1 · scored on 66/66 repositories. Strict scoring (unfinished repos counted as misses).

51.8

F3 (strict)

53.8

F2 (strict)

49.9%

Recall (strict)

77.6%

Precision

66/66

Repos scored

deepseek-v4-flash

Model

Total cost

137s

Avg latency

Per-repository breakdown

Each bar shows true positives, false positives, and misses on one repository; bar length is proportional to that repo's labeled vulnerabilities. Ranked by F2.

True positiveFalse positiveMissed (FN)

pythonssti100 F2 · 100%

intentionally-vulnerable-python-application82 F2 · 81%

vfapi80 F2 · 85%

vulnpy79 F2 · 79%

vulnerable-api75 F2 · 74%

dsvw75 F2 · 72%

dsvpwa74 F2 · 74%

lets-be-bad-guys73 F2 · 69%

insecure-web72 F2 · 74%

dvblab71 F2 · 71%

vampi70 F2 · 73%

python-insecure-app69 F2 · 67%

vulnerable-flask-app67 F2 · 65%

vc-codex-high-seeded-v2-marketplace-commerce-fastapi67 F2 · 64%

python-app66 F2 · 65%

vulnerable-tornado-app66 F2 · 64%

vc-codex-high-seeded-v2-hr-payroll-django64 F2 · 60%

vc-codex-high-seeded-v2-property-management-fastapi64 F2 · 62%

vc-codex-high-seeded-v2-fintech-lending-fastapi63 F2 · 59%

vc-claude-code-seeded-v2-fintech-lending-fastapi62 F2 · 59%

vc-codex-high-seeded-v2-support-desk-fastapi62 F2 · 57%

damn-vulnerable-flask-application61 F2 · 60%

vc-codex-high-seeded-v2-crm-saas-django60 F2 · 56%

vc-kimi-code-seeded-v2-fintech-lending-fastapi58 F2 · 55%

vc-kimi-code-seeded-v2-property-management-fastapi58 F2 · 53%

owasp-web-playground58 F2 · 56%

vc-kimi-code-seeded-v2-legal-case-django57 F2 · 54%

vc-codex-high-seeded-v2-logistics-dispatch-fastapi56 F2 · 52%

vc-kimi-code-seeded-v2-crm-saas-django55 F2 · 52%

vc-kimi-code-seeded-v2-hr-payroll-django55 F2 · 52%

threatbyte55 F2 · 50%

vc-codex-high-seeded-v2-legal-case-django55 F2 · 52%

vc-codex-seeded-v2-marketplace-commerce-fastapi53 F2 · 48%

vc-claude-code-seeded-v2-support-desk-fastapi52 F2 · 47%

vc-codex-seeded-v2-support-desk-fastapi52 F2 · 47%

vc-codex-seeded-v2-property-management-fastapi52 F2 · 48%

vc-codex-seeded-v2-logistics-dispatch-fastapi52 F2 · 47%

vc-claude-code-seeded-v2-legal-case-django50 F2 · 45%

vc-claude-code-seeded-v2-logistics-dispatch-fastapi50 F2 · 45%

vc-codex-high-seeded-v2-healthcare-clinic-django50 F2 · 46%

vc-codex-seeded-v2-crm-saas-django49 F2 · 47%

vc-codex-seeded-v2-hr-payroll-django49 F2 · 44%

vc-claude-code-seeded-v2-education-lms-django48 F2 · 44%

vc-kimi-code-seeded-v2-logistics-dispatch-fastapi48 F2 · 45%

vc-codex-seeded-v2-fintech-lending-fastapi48 F2 · 43%

dvpwa47 F2 · 43%

extremely-vulnerable-flask-app47 F2 · 43%

vc-codex-high-seeded-v2-education-lms-django47 F2 · 44%

vc-claude-code-seeded-v2-property-management-fastapi47 F2 · 42%

vc-claude-code-seeded-v2-hr-payroll-django47 F2 · 44%

vc-kimi-code-seeded-v2-support-desk-fastapi47 F2 · 43%

vulnerable-python-apps47 F2 · 45%

vc-claude-code-seeded-v2-crm-saas-django46 F2 · 43%

vc-codex-seeded-v2-legal-case-django46 F2 · 42%

pygoat46 F2 · 42%

vc-kimi-code-seeded-v2-education-lms-django46 F2 · 43%

vc-claude-code-seeded-v2-healthcare-clinic-django46 F2 · 41%

vc-kimi-code-seeded-v2-marketplace-commerce-fastapi45 F2 · 41%

damn-vulnerable-graphql-application44 F2 · 40%

vc-kimi-code-seeded-v2-healthcare-clinic-django44 F2 · 40%

vc-codex-seeded-v2-healthcare-clinic-django41 F2 · 37%

vulpy40 F2 · 36%

vc-claude-code-seeded-v2-marketplace-commerce-fastapi39 F2 · 34%

flask-xss36 F2 · 31%

vc-codex-seeded-v2-education-lms-django30 F2 · 26%

djangoat28 F2 · 24%

Repository	TP	FP	FN	Recall %	F2
pythonssti	2	0	0	100.0	100.0
intentionally-vulnerable-python-application	6	1	1	81.0	81.7
vfapi	8	4	1	85.2	80.5
vulnpy	63	15	17	78.8	79.0
vulnerable-api	10	2	4	73.8	75.2
dsvw	19	2	8	71.6	74.6
dsvpwa	24	9	8	74.0	73.8
lets-be-bad-guys	17	2	7	69.5	72.7
insecure-web	7	4	2	74.1	71.9
dvblab	16	6	6	71.2	71.4
vampi	11	7	4	73.3	70.5
python-insecure-app	5	1	3	66.7	69.3
vulnerable-flask-app	14	4	7	65.1	67.0
vc-codex-high-seeded-v2-marketplace-commerce-fastapi	16	4	9	64.0	66.7
python-app	14	5	7	65.1	66.2
vulnerable-tornado-app	9	4	5	64.3	65.5
vc-codex-high-seeded-v2-hr-payroll-django	15	3	10	60.0	63.6
vc-codex-high-seeded-v2-property-management-fastapi	16	6	10	61.5	63.5
vc-codex-high-seeded-v2-fintech-lending-fastapi	17	2	12	58.6	63.0
vc-claude-code-seeded-v2-fintech-lending-fastapi	17	4	12	58.6	62.0
vc-codex-high-seeded-v2-support-desk-fastapi	16	2	12	57.1	61.5
damn-vulnerable-flask-application	9	5	6	60.0	60.7
vc-codex-high-seeded-v2-crm-saas-django	14	3	11	56.0	59.8
vc-kimi-code-seeded-v2-fintech-lending-fastapi	18	4	15	54.5	58.4
vc-kimi-code-seeded-v2-property-management-fastapi	16	2	14	53.3	58.0
owasp-web-playground	16	8	12	56.0	57.6
vc-kimi-code-seeded-v2-legal-case-django	14	5	12	53.8	56.9
vc-codex-high-seeded-v2-logistics-dispatch-fastapi	15	3	14	51.7	56.0
vc-kimi-code-seeded-v2-crm-saas-django	14	5	13	51.8	55.1
vc-kimi-code-seeded-v2-hr-payroll-django	15	5	14	51.7	55.1
threatbyte	13	2	13	50.0	54.8
vc-codex-high-seeded-v2-legal-case-django	13	6	12	52.0	54.6
vc-codex-seeded-v2-marketplace-commerce-fastapi	14	2	15	48.3	53.0
vc-claude-code-seeded-v2-support-desk-fastapi	16	1	18	47.1	52.3
vc-codex-seeded-v2-support-desk-fastapi	14	0	16	46.7	52.2
vc-codex-seeded-v2-property-management-fastapi	15	5	16	48.4	52.1
vc-codex-seeded-v2-logistics-dispatch-fastapi	14	2	16	46.7	51.5
vc-claude-code-seeded-v2-legal-case-django	14	1	17	45.2	50.4
vc-claude-code-seeded-v2-logistics-dispatch-fastapi	15	4	18	45.5	49.7
vc-codex-high-seeded-v2-healthcare-clinic-django	12	5	14	46.2	49.6
vc-codex-seeded-v2-crm-saas-django	16	10	18	47.1	49.4
vc-codex-seeded-v2-hr-payroll-django	17	1	22	43.6	48.9
vc-claude-code-seeded-v2-education-lms-django	14	3	18	43.8	48.3
vc-kimi-code-seeded-v2-logistics-dispatch-fastapi	14	7	17	45.2	48.3
vc-codex-seeded-v2-fintech-lending-fastapi	16	2	21	43.2	48.2
dvpwa	10	3	13	43.5	47.4
extremely-vulnerable-flask-app	14	2	18	42.7	47.4
vc-codex-high-seeded-v2-education-lms-django	11	5	14	44.0	47.4
vc-claude-code-seeded-v2-property-management-fastapi	14	2	19	42.4	47.3
vc-claude-code-seeded-v2-hr-payroll-django	12	7	15	44.4	47.2
vc-kimi-code-seeded-v2-support-desk-fastapi	12	3	16	42.9	47.2
vulnerable-python-apps	10	8	12	45.5	47.1
vc-claude-code-seeded-v2-crm-saas-django	12	5	16	42.9	46.5
vc-codex-seeded-v2-legal-case-django	14	6	19	42.4	46.1
pygoat	33	11	45	41.9	45.9
vc-kimi-code-seeded-v2-education-lms-django	12	7	16	42.9	45.8
vc-claude-code-seeded-v2-healthcare-clinic-django	12	4	17	41.4	45.5
vc-kimi-code-seeded-v2-marketplace-commerce-fastapi	11	3	16	40.7	45.1
damn-vulnerable-graphql-application	14	6	22	40.3	44.0
vc-kimi-code-seeded-v2-healthcare-clinic-django	12	5	18	40.0	43.8
vc-codex-seeded-v2-healthcare-clinic-django	15	2	26	36.6	41.4
vulpy	20	3	37	35.7	40.4
vc-claude-code-seeded-v2-marketplace-commerce-fastapi	11	1	21	34.4	39.3
flask-xss	9	2	21	31.1	35.6
vc-codex-seeded-v2-education-lms-django	9	3	26	25.7	29.6
djangoat	13	8	39	24.4	27.7

Detection by severity

Severity	TP	FP	FN	Recall %
Critical	146	0	9	94.2
High	385	1	367	51.2
Medium	369	3	541	40.5
Low	46	2	40	53.5

Detection by vulnerability class

CWE family	TP	FP	FN	Recall %
XML External Entities	38	0	0	100.0
Insecure Deserialization	40	0	0	100.0
HTTP Header Injection	2	0	0	100.0
XPath Injection	4	0	0	100.0
Open Redirect	39	0	1	97.5
Command / OS Injection	48	0	2	96.0
SQL Injection	74	0	4	94.9
Code Injection / RFI	32	0	2	94.1
Path Traversal	40	0	4	90.9
Server-Side Request Forgery	31	1	10	75.6
Cross-Site Scripting	79	0	31	71.8
Security Misconfiguration	67	0	45	59.8
Hardcoded Credentials	36	0	32	52.9
Sensitive Data Exposure	73	0	82	47.1
Other	302	2	575	34.4
Missing Authentication / Authorization	19	3	64	22.9
Broken Access Control / IDOR	19	0	64	22.9
Denial of Service	3	0	41	6.8

LLM operational metrics

34,689

Avg input tokens

11,146

Avg output tokens

240,407

Avg total tokens

137s

Avg latency / repo

0.8%

JSON repair rate

118

Total runs

±13.1

F2 run-to-run σ

Cost

Total cost

$0.01

Cost / run

$0.001

Cost / 100 LOC

133,782

Python LOC scanned

114

Successful runs

← Back to the leaderboard