Scanner deep-dive

GPT-5.6 Terra by OpenAI ↗

General-Purpose LLM · codex-cli · scored on 66/66 repositories. Strict scoring (unfinished repos counted as misses).

48.5

F3 (strict)

50.5

F2 (strict)

46.6%

Recall (strict)

76.4%

Precision

66/66

Repos scored

gpt-5.6-terra

Model

$39

Total cost

111s

Avg latency

Per-repository breakdown

Each bar shows true positives, false positives, and misses on one repository; bar length is proportional to that repo's labeled vulnerabilities. Ranked by F2.

True positiveFalse positiveMissed (FN)

pythonssti100 F2 · 100%

vampi89 F2 · 87%

vfapi89 F2 · 89%

insecure-web81 F2 · 78%

dsvw78 F2 · 74%

python-app71 F2 · 67%

threatbyte66 F2 · 62%

vc-codex-high-seeded-v2-hr-payroll-django65 F2 · 60%

vulnerable-flask-app64 F2 · 62%

dsvpwa64 F2 · 59%

dvblab64 F2 · 59%

vc-codex-high-seeded-v2-marketplace-commerce-fastapi64 F2 · 60%

vc-kimi-code-seeded-v2-legal-case-django64 F2 · 62%

vc-kimi-code-seeded-v2-property-management-fastapi63 F2 · 60%

vc-claude-code-seeded-v2-support-desk-fastapi62 F2 · 59%

vulnerable-api62 F2 · 57%

vc-codex-high-seeded-v2-property-management-fastapi60 F2 · 58%

vc-kimi-code-seeded-v2-logistics-dispatch-fastapi60 F2 · 61%

extremely-vulnerable-flask-app60 F2 · 56%

vc-codex-high-seeded-v2-education-lms-django60 F2 · 56%

vulnerable-tornado-app60 F2 · 57%

vc-claude-code-seeded-v2-legal-case-django59 F2 · 55%

vc-claude-code-seeded-v2-logistics-dispatch-fastapi59 F2 · 55%

lets-be-bad-guys59 F2 · 54%

vc-claude-code-seeded-v2-crm-saas-django57 F2 · 54%

vc-claude-code-seeded-v2-property-management-fastapi56 F2 · 52%

vc-codex-seeded-v2-legal-case-django56 F2 · 52%

vc-codex-high-seeded-v2-logistics-dispatch-fastapi56 F2 · 52%

vc-codex-seeded-v2-marketplace-commerce-fastapi55 F2 · 52%

dvpwa54 F2 · 52%

vc-codex-seeded-v2-logistics-dispatch-fastapi54 F2 · 50%

vc-kimi-code-seeded-v2-marketplace-commerce-fastapi54 F2 · 52%

vc-kimi-code-seeded-v2-fintech-lending-fastapi54 F2 · 48%

vc-codex-high-seeded-v2-fintech-lending-fastapi53 F2 · 52%

python-insecure-app53 F2 · 50%

vc-kimi-code-seeded-v2-support-desk-fastapi52 F2 · 50%

owasp-web-playground52 F2 · 46%

vc-claude-code-seeded-v2-hr-payroll-django52 F2 · 48%

vc-claude-code-seeded-v2-fintech-lending-fastapi52 F2 · 48%

vc-kimi-code-seeded-v2-hr-payroll-django52 F2 · 48%

vc-codex-high-seeded-v2-crm-saas-django51 F2 · 48%

vc-kimi-code-seeded-v2-healthcare-clinic-django50 F2 · 47%

vc-codex-high-seeded-v2-healthcare-clinic-django49 F2 · 46%

vc-codex-seeded-v2-hr-payroll-django48 F2 · 44%

intentionally-vulnerable-python-application47 F2 · 43%

vc-codex-high-seeded-v2-support-desk-fastapi47 F2 · 43%

vc-codex-seeded-v2-support-desk-fastapi47 F2 · 43%

vulnpy46 F2 · 41%

vc-codex-seeded-v2-property-management-fastapi46 F2 · 42%

vc-kimi-code-seeded-v2-education-lms-django45 F2 · 43%

damn-vulnerable-graphql-application44 F2 · 39%

vc-codex-seeded-v2-healthcare-clinic-django43 F2 · 39%

djangoat39 F2 · 35%

vc-codex-seeded-v2-crm-saas-django39 F2 · 35%

vc-claude-code-seeded-v2-marketplace-commerce-fastapi39 F2 · 34%

vc-claude-code-seeded-v2-healthcare-clinic-django38 F2 · 34%

vc-claude-code-seeded-v2-education-lms-django38 F2 · 34%

vc-kimi-code-seeded-v2-crm-saas-django38 F2 · 37%

pygoat37 F2 · 32%

flask-xss34 F2 · 30%

vc-codex-seeded-v2-fintech-lending-fastapi34 F2 · 30%

vc-codex-seeded-v2-education-lms-django32 F2 · 29%

vulpy31 F2 · 26%

damn-vulnerable-flask-application22 F2 · 20%

vulnerable-python-apps21 F2 · 18%

vc-codex-high-seeded-v2-legal-case-django17 F2 · 16%

Repository	TP	FP	FN	Recall %	F2
pythonssti	2	0	0	100.0	100.0
vampi	13	0	2	86.7	89.0
vfapi	8	1	1	88.9	88.9
insecure-web	7	0	2	77.8	81.4
dsvw	20	1	7	74.1	77.5
python-app	14	1	7	66.7	70.7
threatbyte	16	1	10	61.5	66.1
vc-codex-high-seeded-v2-hr-payroll-django	15	1	10	60.0	64.7
vulnerable-flask-app	13	4	8	61.9	64.4
dsvpwa	19	2	13	59.4	63.8
dvblab	13	1	9	59.1	63.7
vc-codex-high-seeded-v2-marketplace-commerce-fastapi	15	3	10	60.0	63.6
vc-kimi-code-seeded-v2-legal-case-django	16	6	10	61.5	63.5
vc-kimi-code-seeded-v2-property-management-fastapi	18	5	12	60.0	62.9
vc-claude-code-seeded-v2-support-desk-fastapi	20	4	14	58.8	62.5
vulnerable-api	8	1	6	57.1	61.5
vc-codex-high-seeded-v2-property-management-fastapi	15	5	11	57.7	60.5
vc-kimi-code-seeded-v2-logistics-dispatch-fastapi	19	14	12	61.3	60.5
extremely-vulnerable-flask-app	18	3	14	56.2	60.4
vc-codex-high-seeded-v2-education-lms-django	14	3	11	56.0	59.8
vulnerable-tornado-app	8	3	6	57.1	59.7
vc-claude-code-seeded-v2-legal-case-django	17	2	14	54.8	59.4
vc-claude-code-seeded-v2-logistics-dispatch-fastapi	18	2	15	54.5	59.2
lets-be-bad-guys	13	2	11	54.2	58.6
vc-claude-code-seeded-v2-crm-saas-django	15	5	13	53.6	56.8
vc-claude-code-seeded-v2-property-management-fastapi	17	2	16	51.5	56.3
vc-codex-seeded-v2-legal-case-django	17	2	16	51.5	56.3
vc-codex-high-seeded-v2-logistics-dispatch-fastapi	15	3	14	51.7	56.0
vc-codex-seeded-v2-marketplace-commerce-fastapi	15	5	14	51.7	55.1
dvpwa	12	6	11	52.2	54.5
vc-codex-seeded-v2-logistics-dispatch-fastapi	15	3	15	50.0	54.3
vc-kimi-code-seeded-v2-marketplace-commerce-fastapi	14	8	13	51.8	53.8
vc-kimi-code-seeded-v2-fintech-lending-fastapi	16	1	17	48.5	53.7
vc-codex-high-seeded-v2-fintech-lending-fastapi	15	10	14	51.7	53.2
python-insecure-app	4	2	4	50.0	52.6
vc-kimi-code-seeded-v2-support-desk-fastapi	14	8	14	50.0	52.2
owasp-web-playground	13	0	15	46.4	52.0
vc-claude-code-seeded-v2-hr-payroll-django	13	5	14	48.1	51.6
vc-claude-code-seeded-v2-fintech-lending-fastapi	14	6	15	48.3	51.5
vc-kimi-code-seeded-v2-hr-payroll-django	14	6	15	48.3	51.5
vc-codex-high-seeded-v2-crm-saas-django	12	5	13	48.0	51.3
vc-kimi-code-seeded-v2-healthcare-clinic-django	14	5	16	46.7	50.4
vc-codex-high-seeded-v2-healthcare-clinic-django	12	6	14	46.2	49.2
vc-codex-seeded-v2-hr-payroll-django	17	3	22	43.6	48.3
intentionally-vulnerable-python-application	3	1	4	42.9	46.9
vc-codex-high-seeded-v2-support-desk-fastapi	12	4	16	42.9	46.9
vc-codex-seeded-v2-support-desk-fastapi	13	6	17	43.3	46.8
vulnpy	33	7	47	41.2	45.8
vc-codex-seeded-v2-property-management-fastapi	13	5	18	41.9	45.8
vc-kimi-code-seeded-v2-education-lms-django	12	10	16	42.9	44.8
damn-vulnerable-graphql-application	14	2	22	38.9	43.8
vc-codex-seeded-v2-healthcare-clinic-django	16	8	25	39.0	42.6
djangoat	18	5	34	34.6	39.0
vc-codex-seeded-v2-crm-saas-django	12	6	22	35.3	39.0
vc-claude-code-seeded-v2-marketplace-commerce-fastapi	11	3	21	34.4	38.7
vc-claude-code-seeded-v2-healthcare-clinic-django	10	4	19	34.5	38.5
vc-claude-code-seeded-v2-education-lms-django	11	5	21	34.4	38.2
vc-kimi-code-seeded-v2-crm-saas-django	10	13	17	37.0	38.2
pygoat	25	4	53	32.0	36.7
flask-xss	9	2	21	30.0	34.4
vc-codex-seeded-v2-fintech-lending-fastapi	11	1	26	29.7	34.4
vc-codex-seeded-v2-education-lms-django	10	5	25	28.6	32.3
vulpy	15	2	42	26.3	30.6
damn-vulnerable-flask-application	3	6	12	20.0	21.7
vulnerable-python-apps	4	4	18	18.2	20.8
vc-codex-high-seeded-v2-legal-case-django	4	14	21	16.0	16.9

Detection by severity

Severity	TP	FP	FN	Recall %
Critical	137	0	18	88.4
High	406	0	346	54.0
Medium	315	1	595	34.6
Low	28	0	58	32.6

Detection by vulnerability class

CWE family	TP	FP	FN	Recall %
XPath Injection	4	0	0	100.0
Open Redirect	39	0	1	97.5
Insecure Deserialization	37	0	3	92.5
Command / OS Injection	45	0	5	90.0
XML External Entities	34	0	4	89.5
SQL Injection	67	0	11	85.9
Code Injection / RFI	28	0	6	82.4
Path Traversal	30	0	14	68.2
Server-Side Request Forgery	27	1	14	65.9
Cross-Site Scripting	65	0	45	59.1
Hardcoded Credentials	38	0	30	55.9
Security Misconfiguration	60	0	52	53.6
HTTP Header Injection	1	0	1	50.0
Sensitive Data Exposure	77	0	78	49.7
Missing Authentication / Authorization	34	0	49	41.0
Denial of Service	18	0	26	40.9
Broken Access Control / IDOR	31	0	52	37.3
Other	251	0	626	28.6

LLM operational metrics

384,521

Avg input tokens

5,219

Avg output tokens

391,543

Avg total tokens

111s

Avg latency / repo

0.0%

JSON repair rate

Total runs

Cost

$39

Total cost

$0.60

Cost / run

$0.029

Cost / 100 LOC

133,782

Python LOC scanned

Successful runs

← Back to the leaderboard