Scanner deep-dive

Qwen 3.6 35B by Alibaba Qwen ↗

General-Purpose LLM · agentic-v1 · scored on 65/66 repositories. Strict scoring (unfinished repos counted as misses).

Methodology note

Locally hosted. Open-weight GGUF (Q4_K_M) via Ollama on one RTX PRO 6000, standard agentic-v1 harness. Cost $0 (self-hosted).

37.0

F3 (strict)

38.7

F2 (strict)

35.5%

Recall (strict)

60.8%

Precision

65/66

Repos scored

qwen3.6-35b

Model

Free

Total cost

222s

Avg latency

Per-repository breakdown

Each bar shows true positives, false positives, and misses on one repository; bar length is proportional to that repo's labeled vulnerabilities. Ranked by F2.

True positiveFalse positiveMissed (FN)

pythonssti91 F2 · 100%

vfapi87 F2 · 89%

dsvw72 F2 · 70%

vulnerable-api71 F2 · 71%

intentionally-vulnerable-python-application69 F2 · 71%

insecure-web67 F2 · 67%

vulnpy65 F2 · 61%

python-insecure-app64 F2 · 62%

vampi64 F2 · 67%

vulnerable-flask-app62 F2 · 62%

vc-kimi-code-seeded-v2-legal-case-django58 F2 · 54%

vc-codex-high-seeded-v2-crm-saas-django58 F2 · 56%

owasp-web-playground57 F2 · 54%

vulnerable-python-apps56 F2 · 55%

python-app55 F2 · 52%

vc-codex-high-seeded-v2-legal-case-django54 F2 · 52%

dsvpwa53 F2 · 50%

vc-kimi-code-seeded-v2-support-desk-fastapi53 F2 · 50%

vc-claude-code-seeded-v2-crm-saas-django53 F2 · 50%

vulnerable-tornado-app52 F2 · 50%

vc-codex-seeded-v2-logistics-dispatch-fastapi51 F2 · 50%

vc-claude-code-seeded-v2-education-lms-django51 F2 · 47%

vc-kimi-code-seeded-v2-property-management-fastapi50 F2 · 47%

threatbyte49 F2 · 46%

vc-kimi-code-seeded-v2-fintech-lending-fastapi49 F2 · 45%

vc-kimi-code-seeded-v2-education-lms-django48 F2 · 46%

dvblab48 F2 · 45%

vc-kimi-code-seeded-v2-crm-saas-django48 F2 · 44%

vc-kimi-code-seeded-v2-marketplace-commerce-fastapi48 F2 · 44%

vc-codex-high-seeded-v2-hr-payroll-django47 F2 · 44%

vc-claude-code-seeded-v2-logistics-dispatch-fastapi47 F2 · 45%

vc-codex-high-seeded-v2-support-desk-fastapi46 F2 · 43%

vc-codex-seeded-v2-hr-payroll-django46 F2 · 41%

vc-claude-code-seeded-v2-legal-case-django45 F2 · 42%

vc-codex-high-seeded-v2-fintech-lending-fastapi45 F2 · 45%

vc-claude-code-seeded-v2-healthcare-clinic-django45 F2 · 41%

vc-codex-high-seeded-v2-logistics-dispatch-fastapi44 F2 · 41%

vc-claude-code-seeded-v2-hr-payroll-django44 F2 · 41%

lets-be-bad-guys44 F2 · 42%

vc-kimi-code-seeded-v2-hr-payroll-django44 F2 · 41%

vc-codex-seeded-v2-fintech-lending-fastapi43 F2 · 41%

vc-codex-seeded-v2-legal-case-django43 F2 · 39%

vc-codex-high-seeded-v2-education-lms-django41 F2 · 40%

vc-kimi-code-seeded-v2-healthcare-clinic-django41 F2 · 40%

vc-codex-seeded-v2-education-lms-django40 F2 · 37%

extremely-vulnerable-flask-app39 F2 · 34%

vc-codex-seeded-v2-property-management-fastapi38 F2 · 35%

vc-claude-code-seeded-v2-fintech-lending-fastapi38 F2 · 34%

vc-claude-code-seeded-v2-support-desk-fastapi36 F2 · 32%

vc-codex-seeded-v2-marketplace-commerce-fastapi35 F2 · 34%

damn-vulnerable-flask-application34 F2 · 33%

flask-xss34 F2 · 30%

dvpwa29 F2 · 26%

djangoat24 F2 · 21%

vulpy22 F2 · 19%

vc-claude-code-seeded-v2-property-management-fastapi18 F2 · 15%

pygoat0 F2 · 0%

vc-claude-code-seeded-v2-marketplace-commerce-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-healthcare-clinic-django0 F2 · 0%

vc-codex-high-seeded-v2-marketplace-commerce-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-property-management-fastapi0 F2 · 0%

vc-codex-seeded-v2-crm-saas-django0 F2 · 0%

vc-codex-seeded-v2-healthcare-clinic-django0 F2 · 0%

vc-codex-seeded-v2-support-desk-fastapi0 F2 · 0%

vc-kimi-code-seeded-v2-logistics-dispatch-fastapi0 F2 · 0%

Repository	TP	FP	FN	Recall %	F2
pythonssti	2	1	0	100.0	90.9
vfapi	8	2	1	88.9	87.0
dsvw	19	4	8	70.4	72.5
vulnerable-api	10	4	4	71.4	71.4
intentionally-vulnerable-python-application	5	3	2	71.4	69.4
insecure-web	6	3	3	66.7	66.7
vulnpy	49	6	31	61.3	65.3
python-insecure-app	5	2	3	62.5	64.1
vampi	10	8	5	66.7	64.1
vulnerable-flask-app	13	8	8	61.9	61.9
vc-kimi-code-seeded-v2-legal-case-django	14	2	12	53.8	58.3
vc-codex-high-seeded-v2-crm-saas-django	14	7	11	56.0	57.9
owasp-web-playground	15	5	13	53.6	56.8
vulnerable-python-apps	12	8	10	54.5	55.6
python-app	11	5	10	52.4	55.0
vc-codex-high-seeded-v2-legal-case-django	13	8	12	52.0	53.7
dsvpwa	16	7	16	50.0	53.0
vc-kimi-code-seeded-v2-support-desk-fastapi	14	6	14	50.0	53.0
vc-claude-code-seeded-v2-crm-saas-django	14	7	14	50.0	52.6
vulnerable-tornado-app	7	5	7	50.0	51.5
vc-codex-seeded-v2-logistics-dispatch-fastapi	15	11	15	50.0	51.4
vc-claude-code-seeded-v2-education-lms-django	15	5	17	46.9	50.7
vc-kimi-code-seeded-v2-property-management-fastapi	14	6	16	46.7	50.0
threatbyte	12	7	14	46.2	48.8
vc-kimi-code-seeded-v2-fintech-lending-fastapi	15	7	18	45.5	48.7
vc-kimi-code-seeded-v2-education-lms-django	13	9	15	46.4	48.5
dvblab	10	7	12	45.5	47.6
vc-kimi-code-seeded-v2-crm-saas-django	12	6	15	44.4	47.6
vc-kimi-code-seeded-v2-marketplace-commerce-fastapi	12	6	15	44.4	47.6
vc-codex-high-seeded-v2-hr-payroll-django	11	5	14	44.0	47.4
vc-claude-code-seeded-v2-logistics-dispatch-fastapi	15	13	18	45.5	46.9
vc-codex-high-seeded-v2-support-desk-fastapi	12	6	16	42.9	46.2
vc-codex-seeded-v2-hr-payroll-django	16	2	23	41.0	46.0
vc-claude-code-seeded-v2-legal-case-django	13	7	18	41.9	45.1
vc-codex-high-seeded-v2-fintech-lending-fastapi	13	15	16	44.8	45.1
vc-claude-code-seeded-v2-healthcare-clinic-django	12	6	17	41.4	44.8
vc-codex-high-seeded-v2-logistics-dispatch-fastapi	12	8	17	41.4	44.1
vc-claude-code-seeded-v2-hr-payroll-django	11	7	16	40.7	43.7
lets-be-bad-guys	10	9	14	41.7	43.5
vc-kimi-code-seeded-v2-hr-payroll-django	12	10	17	41.4	43.5
vc-codex-seeded-v2-fintech-lending-fastapi	15	10	22	40.5	43.4
vc-codex-seeded-v2-legal-case-django	13	7	20	39.4	42.8
vc-codex-high-seeded-v2-education-lms-django	10	11	15	40.0	41.3
vc-kimi-code-seeded-v2-healthcare-clinic-django	12	14	18	40.0	41.1
vc-codex-seeded-v2-education-lms-django	13	10	22	37.1	39.9
extremely-vulnerable-flask-app	11	1	21	34.4	39.3
vc-codex-seeded-v2-property-management-fastapi	11	8	20	35.5	38.5
vc-claude-code-seeded-v2-fintech-lending-fastapi	10	5	19	34.5	38.2
vc-claude-code-seeded-v2-support-desk-fastapi	11	4	23	32.4	36.4
vc-codex-seeded-v2-marketplace-commerce-fastapi	10	18	19	34.5	34.7
damn-vulnerable-flask-application	5	8	10	33.3	34.2
flask-xss	9	3	21	30.0	34.1
dvpwa	6	7	17	26.1	28.6
djangoat	11	11	41	21.1	23.9
vulpy	11	7	46	19.3	22.4
vc-claude-code-seeded-v2-property-management-fastapi	5	0	28	15.2	18.2
pygoat	0	0	78	0.0	0.0
vc-claude-code-seeded-v2-marketplace-commerce-fastapi	0	10	32	0.0	0.0
vc-codex-high-seeded-v2-healthcare-clinic-django	0	0	26	0.0	0.0
vc-codex-high-seeded-v2-marketplace-commerce-fastapi	0	14	25	0.0	0.0
vc-codex-high-seeded-v2-property-management-fastapi	0	0	26	0.0	0.0
vc-codex-seeded-v2-crm-saas-django	0	0	34	0.0	0.0
vc-codex-seeded-v2-healthcare-clinic-django	0	17	41	0.0	0.0
vc-codex-seeded-v2-support-desk-fastapi	0	18	30	0.0	0.0
vc-kimi-code-seeded-v2-logistics-dispatch-fastapi	0	0	31	0.0	0.0

Detection by severity

Severity	TP	FP	FN	Recall %
Critical	103	0	48	68.2
High	292	8	446	39.6
Medium	259	6	634	29.0
Low	21	1	64	24.7

Detection by vulnerability class

CWE family	TP	FP	FN	Recall %
HTTP Header Injection	2	0	0	100.0
XPath Injection	4	0	0	100.0
Insecure Deserialization	32	0	8	80.0
Open Redirect	31	0	9	77.5
XML External Entities	29	1	9	76.3
Command / OS Injection	34	0	13	72.3
SQL Injection	55	4	22	71.4
Code Injection / RFI	23	0	11	67.6
Server-Side Request Forgery	27	2	13	67.5
Path Traversal	29	3	14	67.4
Cross-Site Scripting	54	0	54	50.0
Hardcoded Credentials	31	0	36	46.3
Security Misconfiguration	46	0	65	41.4
Other	223	1	643	25.8
Sensitive Data Exposure	33	1	116	22.1
Broken Access Control / IDOR	11	0	70	13.6
Denial of Service	4	0	39	9.3
Missing Authentication / Authorization	7	3	70	9.1

LLM operational metrics

189,528

Avg input tokens

9,021

Avg output tokens

198,550

Avg total tokens

222s

Avg latency / repo

18.2%

JSON repair rate

Total runs

Cost

Free

Total cost

131,775

Python LOC scanned

Successful runs

← Back to the leaderboard