Scanner deep-dive
Kolega Scan OSS - V2 - 3 Model by Kolega Scan OSS ↗
Security-Specialized · Kolega Scan OSS · scored on 66/66 repositories. Strict scoring (unfinished repos counted as misses).
67.5
F3 (strict)
60.1
F2 (strict)
77.0%
Recall (strict)
31.9%
Precision
66/66
Repos scored
twin-distill-flash-r4
Model
$146
Total cost
0s
Avg latency
§
Per-repository breakdown
Each bar shows true positives, false positives, and misses on one repository; bar length is proportional to that repo's labeled vulnerabilities. Ranked by F2.
| Repository | TP | FP | FN | Recall % | F2 |
|---|---|---|---|---|---|
| dsvw | 25 | 22 | 2 | 92.6 | 80.6 |
| extremely-vulnerable-flask-app | 30 | 31 | 2 | 93.8 | 79.4 |
| dsvpwa | 29 | 31 | 3 | 90.6 | 77.1 |
| vc-codex-seeded-v2-healthcare-clinic-django | 36 | 34 | 5 | 87.8 | 76.9 |
| vc-codex-seeded-v2-hr-payroll-django | 33 | 28 | 6 | 84.6 | 76.0 |
| vc-claude-code-seeded-v2-legal-case-django | 29 | 49 | 2 | 93.5 | 71.8 |
| pythonssti | 2 | 4 | 0 | 100.0 | 71.4 |
| vc-claude-code-seeded-v2-logistics-dispatch-fastapi | 30 | 50 | 3 | 90.9 | 70.8 |
| vulnerable-api | 12 | 17 | 2 | 85.7 | 70.6 |
| vc-codex-seeded-v2-logistics-dispatch-fastapi | 28 | 53 | 2 | 93.3 | 69.7 |
| owasp-web-playground | 23 | 35 | 5 | 82.1 | 67.6 |
| vc-claude-code-seeded-v2-property-management-fastapi | 27 | 42 | 6 | 81.8 | 67.2 |
| python-app | 20 | 45 | 1 | 95.2 | 67.1 |
| vulnerable-tornado-app | 13 | 29 | 1 | 92.9 | 66.3 |
| vc-codex-seeded-v2-property-management-fastapi | 26 | 46 | 5 | 83.9 | 66.3 |
| vc-codex-seeded-v2-support-desk-fastapi | 26 | 51 | 4 | 86.7 | 66.0 |
| intentionally-vulnerable-python-application | 7 | 19 | 0 | 100.0 | 64.8 |
| vc-codex-high-seeded-v2-marketplace-commerce-fastapi | 22 | 48 | 3 | 88.0 | 64.7 |
| vc-codex-high-seeded-v2-fintech-lending-fastapi | 23 | 39 | 6 | 79.3 | 64.6 |
| vc-codex-seeded-v2-marketplace-commerce-fastapi | 24 | 46 | 5 | 82.8 | 64.5 |
| damn-vulnerable-flask-application | 13 | 28 | 2 | 86.7 | 64.4 |
| vc-codex-seeded-v2-fintech-lending-fastapi | 29 | 49 | 8 | 78.4 | 64.2 |
| damn-vulnerable-graphql-application | 27 | 40 | 9 | 75.0 | 64.0 |
| dvblab | 19 | 42 | 3 | 86.4 | 63.8 |
| vc-kimi-code-seeded-v2-fintech-lending-fastapi | 28 | 60 | 5 | 84.9 | 63.6 |
| vulpy | 43 | 69 | 14 | 75.4 | 63.2 |
| vc-codex-high-seeded-v2-logistics-dispatch-fastapi | 24 | 51 | 5 | 82.8 | 62.8 |
| vc-kimi-code-seeded-v2-support-desk-fastapi | 25 | 62 | 3 | 89.3 | 62.8 |
| pygoat | 61 | 114 | 17 | 78.2 | 62.6 |
| vc-codex-seeded-v2-education-lms-django | 24 | 28 | 11 | 68.6 | 62.5 |
| vc-claude-code-seeded-v2-support-desk-fastapi | 25 | 41 | 9 | 73.5 | 61.9 |
| vc-claude-code-seeded-v2-fintech-lending-fastapi | 26 | 71 | 3 | 89.7 | 61.0 |
| vc-claude-code-seeded-v2-marketplace-commerce-fastapi | 24 | 46 | 8 | 75.0 | 60.6 |
| threatbyte | 21 | 50 | 5 | 80.8 | 60.0 |
| vc-kimi-code-seeded-v2-property-management-fastapi | 28 | 86 | 2 | 93.3 | 59.8 |
| dvpwa | 18 | 41 | 5 | 78.3 | 59.6 |
| vampi | 13 | 36 | 2 | 86.7 | 59.6 |
| insecure-web | 7 | 16 | 2 | 77.8 | 59.3 |
| vc-codex-high-seeded-v2-hr-payroll-django | 21 | 56 | 4 | 84.0 | 59.3 |
| vc-kimi-code-seeded-v2-education-lms-django | 23 | 59 | 5 | 82.1 | 59.3 |
| vc-kimi-code-seeded-v2-hr-payroll-django | 23 | 55 | 6 | 79.3 | 59.3 |
| vfapi | 8 | 24 | 1 | 88.9 | 58.8 |
| lets-be-bad-guys | 17 | 33 | 7 | 70.8 | 58.2 |
| python-insecure-app | 5 | 6 | 3 | 62.5 | 58.1 |
| vc-codex-seeded-v2-crm-saas-django | 25 | 59 | 9 | 73.5 | 56.8 |
| vc-kimi-code-seeded-v2-legal-case-django | 21 | 61 | 5 | 80.8 | 56.5 |
| vc-codex-high-seeded-v2-support-desk-fastapi | 21 | 54 | 7 | 75.0 | 56.1 |
| vc-codex-high-seeded-v2-healthcare-clinic-django | 18 | 41 | 8 | 69.2 | 55.2 |
| vc-codex-high-seeded-v2-property-management-fastapi | 20 | 57 | 6 | 76.9 | 55.2 |
| vc-codex-high-seeded-v2-education-lms-django | 18 | 46 | 7 | 72.0 | 54.9 |
| vc-kimi-code-seeded-v2-logistics-dispatch-fastapi | 27 | 96 | 4 | 87.1 | 54.7 |
| vc-claude-code-seeded-v2-hr-payroll-django | 18 | 41 | 9 | 66.7 | 53.9 |
| vulnerable-flask-app | 16 | 49 | 5 | 76.2 | 53.7 |
| vc-kimi-code-seeded-v2-healthcare-clinic-django | 21 | 57 | 9 | 70.0 | 53.0 |
| vc-codex-high-seeded-v2-crm-saas-django | 18 | 52 | 7 | 72.0 | 52.9 |
| vc-codex-seeded-v2-legal-case-django | 21 | 47 | 12 | 63.6 | 52.5 |
| vc-codex-high-seeded-v2-legal-case-django | 17 | 48 | 8 | 68.0 | 51.5 |
| vc-claude-code-seeded-v2-education-lms-django | 19 | 41 | 13 | 59.4 | 50.5 |
| vc-claude-code-seeded-v2-healthcare-clinic-django | 22 | 80 | 7 | 75.9 | 50.5 |
| vulnpy | 42 | 59 | 38 | 52.5 | 49.9 |
| vc-kimi-code-seeded-v2-crm-saas-django | 19 | 66 | 8 | 70.4 | 49.2 |
| vc-kimi-code-seeded-v2-marketplace-commerce-fastapi | 22 | 96 | 5 | 81.5 | 48.7 |
| flask-xss | 15 | 33 | 15 | 50.0 | 44.6 |
| vc-claude-code-seeded-v2-crm-saas-django | 14 | 38 | 14 | 50.0 | 42.7 |
| djangoat | 25 | 75 | 27 | 48.1 | 40.6 |
| vulnerable-python-apps | 10 | 48 | 12 | 45.5 | 34.2 |
§
Detection by severity
| Severity | TP | FP | FN | Recall % |
|---|---|---|---|---|
| Critical | 139 | 2 | 16 | 89.7 |
| High | 576 | 8 | 176 | 76.6 |
| Medium | 693 | 8 | 217 | 76.2 |
| Low | 58 | 1 | 28 | 67.4 |
§
Detection by vulnerability class
| CWE family | TP | FP | FN | Recall % |
|---|---|---|---|---|
| HTTP Header Injection | 2 | 0 | 0 | 100.0 |
| Open Redirect | 39 | 0 | 1 | 97.5 |
| XML External Entities | 35 | 0 | 3 | 92.1 |
| Command / OS Injection | 44 | 0 | 6 | 88.0 |
| Security Misconfiguration | 97 | 0 | 15 | 86.6 |
| Path Traversal | 38 | 1 | 6 | 86.4 |
| Code Injection / RFI | 29 | 0 | 5 | 85.3 |
| SQL Injection | 66 | 2 | 12 | 84.6 |
| Hardcoded Credentials | 57 | 2 | 11 | 83.8 |
| Cross-Site Scripting | 87 | 0 | 23 | 79.1 |
| Sensitive Data Exposure | 121 | 0 | 34 | 78.1 |
| Insecure Deserialization | 31 | 0 | 9 | 77.5 |
| XPath Injection | 3 | 0 | 1 | 75.0 |
| Server-Side Request Forgery | 30 | 2 | 11 | 73.2 |
| Other | 638 | 5 | 239 | 72.7 |
| Broken Access Control / IDOR | 60 | 4 | 23 | 72.3 |
| Denial of Service | 31 | 0 | 13 | 70.5 |
| Missing Authentication / Authorization | 58 | 3 | 25 | 69.9 |
§
LLM operational metrics
0
Avg input tokens
0
Avg output tokens
0
Avg total tokens
0s
Avg latency / repo
0.0%
JSON repair rate
66
Total runs
§
Cost
$146
Total cost
$2.21
Cost / run
$0.109
Cost / 100 LOC
133,782
Python LOC scanned
66
Successful runs