Scanner deep-dive

Semgrep by Semgrep ↗

Rule-Based SAST · rule-based · scored on 140/140 repositories. Strict scoring (unfinished repos counted as misses).

10.0

F3 (strict)

10.2

F2 (strict)

9.9%

Recall (strict)

11.5%

Precision

140/140

Repos scored

—

Model

Free

Total cost

—

Avg latency

Per-repository breakdown

Each bar shows true positives, false positives, and misses on one repository; bar length is proportional to that repo's labeled vulnerabilities. Ranked by F2.

True positiveFalse positiveMissed (FN)

node-api-goat69 F2 · 100%

pythonssti56 F2 · 50%

insecure-web48 F2 · 56%

lets-be-bad-guys40 F2 · 38%

dvna37 F2 · 41%

dvblab34 F2 · 36%

damn-vulnerable-flask-application32 F2 · 36%

intentionally-vulnerable-python-application30 F2 · 29%

vulnerable-api30 F2 · 29%

vulpy29 F2 · 28%

pygoat28 F2 · 32%

vc-kimi-code-seeded-v3-fintech-lending-express25 F2 · 31%

djangoat21 F2 · 21%

dsvpwa21 F2 · 19%

extremely-vulnerable-flask-app21 F2 · 19%

vulnerable-app-angular20 F2 · 25%

vuln-node-express19 F2 · 20%

vulnerable-node19 F2 · 24%

nodegoat19 F2 · 21%

vulnpy18 F2 · 16%

vc-codex-high-seeded-v3-fintech-lending-express18 F2 · 18%

vc-codex-high-seeded-v3-crm-saas-nestjs-angular17 F2 · 19%

vc-codex-high-seeded-v3-marketplace-commerce-express17 F2 · 16%

vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue17 F2 · 20%

vuln-node-express-swagger17 F2 · 16%

vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express17 F2 · 19%

vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs17 F2 · 15%

vc-kimi-code-seeded-v3-marketplace-commerce-express16 F2 · 21%

vc-claude-code-seeded-v3-property-management-fastify-vue16 F2 · 16%

vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular16 F2 · 16%

ninjasworkout16 F2 · 23%

vc-claude-code-seeded-v3-marketplace-commerce-express16 F2 · 18%

xvna16 F2 · 17%

vc-kimi-code-seeded-v3-support-desk-nestjs-angular16 F2 · 16%

vc-claude-code-seeded-v3-fintech-lending-express15 F2 · 20%

vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express15 F2 · 19%

vulnerable-flask-app15 F2 · 14%

react-security15 F2 · 14%

vulnerable-react-fatih15 F2 · 14%

juice-shop-goof14 F2 · 18%

vc-kimi-code-seeded-v3-property-management-fastify-vue14 F2 · 16%

vc-kimi-code-seeded-v3-education-lms-nextjs14 F2 · 13%

owasp-web-playground14 F2 · 21%

vfapi14 F2 · 11%

nodejs-goof13 F2 · 18%

vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue13 F2 · 12%

vc-claude-code-seeded-v3-healthcare-clinic-nextjs13 F2 · 12%

vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue13 F2 · 16%

vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs13 F2 · 12%

vc-kimi-code-seeded-v3-crm-saas-nestjs-angular13 F2 · 12%

dvws-node13 F2 · 12%

threatbyte12 F2 · 12%

vc-codex-high-seeded-v3-healthcare-clinic-nextjs12 F2 · 12%

vc-kimi-code-seeded-v3-healthcare-clinic-nextjs12 F2 · 11%

vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix12 F2 · 11%

flask-xss12 F2 · 10%

vc-codex-high-seeded-v3-support-desk-nestjs-angular12 F2 · 11%

vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs11 F2 · 11%

vc-kimi-code-seeded-v3-hr-payroll-remix11 F2 · 11%

juice-shop11 F2 · 11%

vc-codex-high-seeded-v3-hr-payroll-remix11 F2 · 10%

vc-deepseek-v4-pro-seeded-v3-fintech-lending-express11 F2 · 11%

vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue10 F2 · 10%

vc-deepseek-v4-flash-seeded-v3-fintech-lending-express10 F2 · 14%

vulnerable-python-apps10 F2 · 9%

vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular10 F2 · 9%

dvpwa10 F2 · 9%

vc-deepseek-v4-flash-seeded-v3-legal-case-remix9 F2 · 9%

vc-claude-code-seeded-v3-crm-saas-nestjs-angular9 F2 · 8%

vc-claude-code-seeded-v3-education-lms-nextjs9 F2 · 8%

vulnnodeapp8 F2 · 28%

vc-claude-code-seeded-v3-support-desk-nestjs-angular8 F2 · 7%

vulnerable-tornado-app8 F2 · 7%

vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs8 F2 · 7%

vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular7 F2 · 7%

damn-vulnerable-graphql-application6 F2 · 6%

oss-oopssec-store6 F2 · 5%

vc-codex-high-seeded-v3-property-management-fastify-vue6 F2 · 5%

vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue5 F2 · 4%

ivna5 F2 · 5%

vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular4 F2 · 4%

vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix4 F2 · 4%

vc-claude-code-seeded-v3-legal-case-remix4 F2 · 4%

vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue4 F2 · 4%

vc-claude-code-seeded-v3-hr-payroll-remix3 F2 · 3%

vc-kimi-code-seeded-v3-legal-case-remix3 F2 · 2%

vc-codex-high-seeded-v3-legal-case-remix3 F2 · 2%

dsvw0 F2 · 0%

nextjs-vulnerable-app0 F2 · 0%

python-app0 F2 · 0%

python-insecure-app0 F2 · 0%

react-test-bench0 F2 · 0%

reactvulna0 F2 · 0%

simply-vulnerable-react0 F2 · 0%

vampi0 F2 · 0%

vulnerable-nodejs0 F2 · 0%

vulnerable-rest-api-owasp-20230 F2 · 0%

vc-claude-code-seeded-v2-crm-saas-django0 F2 · 0%

vc-claude-code-seeded-v2-education-lms-django0 F2 · 0%

vc-claude-code-seeded-v2-fintech-lending-fastapi0 F2 · 0%

vc-claude-code-seeded-v2-healthcare-clinic-django0 F2 · 0%

vc-claude-code-seeded-v2-hr-payroll-django0 F2 · 0%

vc-claude-code-seeded-v2-legal-case-django0 F2 · 0%

vc-claude-code-seeded-v2-logistics-dispatch-fastapi0 F2 · 0%

vc-claude-code-seeded-v2-marketplace-commerce-fastapi0 F2 · 0%

vc-claude-code-seeded-v2-property-management-fastapi0 F2 · 0%

vc-claude-code-seeded-v2-support-desk-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-crm-saas-django0 F2 · 0%

vc-codex-high-seeded-v2-education-lms-django0 F2 · 0%

vc-codex-high-seeded-v2-fintech-lending-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-healthcare-clinic-django0 F2 · 0%

vc-codex-high-seeded-v2-hr-payroll-django0 F2 · 0%

vc-codex-high-seeded-v2-legal-case-django0 F2 · 0%

vc-codex-high-seeded-v2-logistics-dispatch-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-marketplace-commerce-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-property-management-fastapi0 F2 · 0%

vc-codex-high-seeded-v2-support-desk-fastapi0 F2 · 0%

vc-codex-high-seeded-v3-education-lms-nextjs0 F2 · 0%

vc-codex-seeded-v2-crm-saas-django0 F2 · 0%

vc-codex-seeded-v2-education-lms-django0 F2 · 0%

vc-codex-seeded-v2-fintech-lending-fastapi0 F2 · 0%

vc-codex-seeded-v2-healthcare-clinic-django0 F2 · 0%

vc-codex-seeded-v2-hr-payroll-django0 F2 · 0%

vc-codex-seeded-v2-legal-case-django0 F2 · 0%

vc-codex-seeded-v2-logistics-dispatch-fastapi0 F2 · 0%

vc-codex-seeded-v2-marketplace-commerce-fastapi0 F2 · 0%

vc-codex-seeded-v2-property-management-fastapi0 F2 · 0%

vc-codex-seeded-v2-support-desk-fastapi0 F2 · 0%

vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue0 F2 · 0%

vc-deepseek-v4-pro-seeded-v3-legal-case-remix0 F2 · 0%

vc-kimi-code-seeded-v2-crm-saas-django0 F2 · 0%

vc-kimi-code-seeded-v2-education-lms-django0 F2 · 0%

vc-kimi-code-seeded-v2-fintech-lending-fastapi0 F2 · 0%

vc-kimi-code-seeded-v2-healthcare-clinic-django0 F2 · 0%

vc-kimi-code-seeded-v2-hr-payroll-django0 F2 · 0%

vc-kimi-code-seeded-v2-legal-case-django0 F2 · 0%

vc-kimi-code-seeded-v2-logistics-dispatch-fastapi0 F2 · 0%

vc-kimi-code-seeded-v2-marketplace-commerce-fastapi0 F2 · 0%

vc-kimi-code-seeded-v2-property-management-fastapi0 F2 · 0%

vc-kimi-code-seeded-v2-support-desk-fastapi0 F2 · 0%

Repository	TP	FP	FN	Recall %	F2
node-api-goat	7	16	0	100.0	68.6
pythonssti	1	0	1	50.0	55.6
insecure-web	5	11	4	55.6	48.1
lets-be-bad-guys	9	8	15	37.5	39.8
dvna	7	20	10	41.2	36.8
dvblab	8	22	14	36.4	33.9
damn-vulnerable-flask-application	5	16	9	35.7	32.5
intentionally-vulnerable-python-application	2	3	5	28.6	30.3
vulnerable-api	4	6	10	28.6	30.3
vulpy	16	29	41	28.1	29.3
pygoat	25	108	53	32.0	28.1
vc-kimi-code-seeded-v3-fintech-lending-express	13	80	29	30.9	24.9
djangoat	11	38	41	21.1	21.4
dsvpwa	6	7	26	18.8	21.3
extremely-vulnerable-flask-app	6	8	26	18.8	21.1
vulnerable-app-angular	2	15	6	25.0	20.4
vuln-node-express	1	5	4	20.0	19.2
vulnerable-node	5	41	16	23.8	19.2
nodegoat	6	42	22	21.4	18.8
vulnpy	13	22	67	16.2	18.3
vc-codex-high-seeded-v3-fintech-lending-express	7	35	32	17.9	17.7
vc-codex-high-seeded-v3-crm-saas-nestjs-angular	7	47	30	18.9	17.3
vc-codex-high-seeded-v3-marketplace-commerce-express	7	22	37	15.9	17.1
vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue	9	79	35	20.4	17.0
vuln-node-express-swagger	8	33	41	16.3	16.9
vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express	5	39	21	19.2	16.9
vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs	4	12	22	15.4	16.7
vc-kimi-code-seeded-v3-marketplace-commerce-express	9	95	34	20.9	16.3
vc-claude-code-seeded-v3-property-management-fastify-vue	5	22	27	15.6	16.1
vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular	3	14	16	15.8	16.1
ninjasworkout	5	65	17	22.7	15.8
vc-claude-code-seeded-v3-marketplace-commerce-express	7	55	33	17.5	15.8
xvna	2	14	10	16.7	15.6
vc-kimi-code-seeded-v3-support-desk-nestjs-angular	5	27	27	15.6	15.6
vc-claude-code-seeded-v3-fintech-lending-express	8	92	32	20.0	15.4
vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express	4	42	17	19.1	15.4
vulnerable-flask-app	3	11	18	14.3	15.3
react-security	1	4	6	14.3	15.2
vulnerable-react-fatih	1	5	6	14.3	14.7
juice-shop-goof	9	97	42	17.6	14.5
vc-kimi-code-seeded-v3-property-management-fastify-vue	5	39	27	15.6	14.5
vc-kimi-code-seeded-v3-education-lms-nextjs	6	22	40	13.0	14.2
owasp-web-playground	6	104	22	21.4	13.5
vfapi	1	0	8	11.1	13.5
nodejs-goof	3	41	14	17.6	13.4
vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue	6	18	45	11.8	13.2
vc-claude-code-seeded-v3-healthcare-clinic-nextjs	5	16	38	11.6	13.0
vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue	3	36	16	15.8	13.0
vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs	3	18	21	12.5	12.8
vc-kimi-code-seeded-v3-crm-saas-nestjs-angular	5	30	35	12.5	12.8
dvws-node	9	39	68	11.7	12.6
threatbyte	3	14	23	11.5	12.4
vc-codex-high-seeded-v3-healthcare-clinic-nextjs	5	28	37	11.9	12.4
vc-kimi-code-seeded-v3-healthcare-clinic-nextjs	4	15	32	11.1	12.3
vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix	2	8	16	11.1	12.2
flask-xss	3	1	27	10.0	12.1
vc-codex-high-seeded-v3-support-desk-nestjs-angular	4	30	31	11.4	11.5
vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs	3	18	25	10.7	11.3
vc-kimi-code-seeded-v3-hr-payroll-remix	4	29	32	11.1	11.3
juice-shop	9	68	72	11.1	11.2
vc-codex-high-seeded-v3-hr-payroll-remix	4	7	38	9.5	11.2
vc-deepseek-v4-pro-seeded-v3-fintech-lending-express	3	29	24	11.1	10.7
vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue	3	20	27	10.0	10.5
vc-deepseek-v4-flash-seeded-v3-fintech-lending-express	3	55	19	13.6	10.3
vulnerable-python-apps	2	10	20	9.1	10.0
vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular	2	10	20	9.1	10.0
dvpwa	2	8	21	8.7	9.8
vc-deepseek-v4-flash-seeded-v3-legal-case-remix	2	16	20	9.1	9.4
vc-claude-code-seeded-v3-crm-saas-nestjs-angular	4	16	45	8.2	9.3
vc-claude-code-seeded-v3-education-lms-nextjs	3	13	35	7.9	8.9
vulnnodeapp	8	355	21	27.6	8.4
vc-claude-code-seeded-v3-support-desk-nestjs-angular	3	22	38	7.3	7.9
vulnerable-tornado-app	1	8	13	7.1	7.7
vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs	2	21	25	7.4	7.6
vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular	2	19	28	6.7	7.1
damn-vulnerable-graphql-application	2	7	34	5.6	6.5
oss-oopssec-store	2	15	38	5.0	5.6
vc-codex-high-seeded-v3-property-management-fastify-vue	2	8	40	4.8	5.6
vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue	2	7	43	4.4	5.3
ivna	1	30	18	5.3	4.7
vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular	1	13	23	4.2	4.5
vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix	1	6	25	3.9	4.5
vc-claude-code-seeded-v3-legal-case-remix	1	8	27	3.6	4.1
vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue	1	8	27	3.6	4.1
vc-claude-code-seeded-v3-hr-payroll-remix	1	5	36	2.7	3.2
vc-kimi-code-seeded-v3-legal-case-remix	1	3	40	2.4	3.0
vc-codex-high-seeded-v3-legal-case-remix	1	5	46	2.1	2.6
dsvw	0	0	27	0.0	0.0
nextjs-vulnerable-app	0	0	1	0.0	0.0
python-app	0	40	21	0.0	0.0
python-insecure-app	0	0	8	0.0	0.0
react-test-bench	0	6	1	0.0	0.0
reactvulna	0	0	1	0.0	0.0
simply-vulnerable-react	0	19	1	0.0	0.0
vampi	0	0	15	0.0	0.0
vulnerable-nodejs	0	8	19	0.0	0.0
vulnerable-rest-api-owasp-2023	0	25	15	0.0	0.0
vc-claude-code-seeded-v2-crm-saas-django	0	18	28	0.0	0.0
vc-claude-code-seeded-v2-education-lms-django	0	19	32	0.0	0.0
vc-claude-code-seeded-v2-fintech-lending-fastapi	0	9	29	0.0	0.0
vc-claude-code-seeded-v2-healthcare-clinic-django	0	16	29	0.0	0.0
vc-claude-code-seeded-v2-hr-payroll-django	0	21	27	0.0	0.0
vc-claude-code-seeded-v2-legal-case-django	0	20	31	0.0	0.0
vc-claude-code-seeded-v2-logistics-dispatch-fastapi	0	8	33	0.0	0.0
vc-claude-code-seeded-v2-marketplace-commerce-fastapi	0	2	32	0.0	0.0
vc-claude-code-seeded-v2-property-management-fastapi	0	4	33	0.0	0.0
vc-claude-code-seeded-v2-support-desk-fastapi	0	4	34	0.0	0.0
vc-codex-high-seeded-v2-crm-saas-django	0	11	25	0.0	0.0
vc-codex-high-seeded-v2-education-lms-django	0	12	25	0.0	0.0
vc-codex-high-seeded-v2-fintech-lending-fastapi	0	10	29	0.0	0.0
vc-codex-high-seeded-v2-healthcare-clinic-django	0	13	26	0.0	0.0
vc-codex-high-seeded-v2-hr-payroll-django	0	12	25	0.0	0.0
vc-codex-high-seeded-v2-legal-case-django	0	13	25	0.0	0.0
vc-codex-high-seeded-v2-logistics-dispatch-fastapi	0	10	29	0.0	0.0
vc-codex-high-seeded-v2-marketplace-commerce-fastapi	0	2	25	0.0	0.0
vc-codex-high-seeded-v2-property-management-fastapi	0	5	26	0.0	0.0
vc-codex-high-seeded-v2-support-desk-fastapi	0	1	28	0.0	0.0
vc-codex-high-seeded-v3-education-lms-nextjs	0	2	48	0.0	0.0
vc-codex-seeded-v2-crm-saas-django	0	11	34	0.0	0.0
vc-codex-seeded-v2-education-lms-django	0	8	35	0.0	0.0
vc-codex-seeded-v2-fintech-lending-fastapi	0	7	37	0.0	0.0
vc-codex-seeded-v2-healthcare-clinic-django	0	11	41	0.0	0.0
vc-codex-seeded-v2-hr-payroll-django	0	12	39	0.0	0.0
vc-codex-seeded-v2-legal-case-django	0	10	33	0.0	0.0
vc-codex-seeded-v2-logistics-dispatch-fastapi	0	6	30	0.0	0.0
vc-codex-seeded-v2-marketplace-commerce-fastapi	0	7	29	0.0	0.0
vc-codex-seeded-v2-property-management-fastapi	0	7	31	0.0	0.0
vc-codex-seeded-v2-support-desk-fastapi	0	1	30	0.0	0.0
vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue	0	11	25	0.0	0.0
vc-deepseek-v4-pro-seeded-v3-legal-case-remix	0	5	25	0.0	0.0
vc-kimi-code-seeded-v2-crm-saas-django	0	21	27	0.0	0.0
vc-kimi-code-seeded-v2-education-lms-django	0	15	28	0.0	0.0
vc-kimi-code-seeded-v2-fintech-lending-fastapi	0	8	33	0.0	0.0
vc-kimi-code-seeded-v2-healthcare-clinic-django	0	19	30	0.0	0.0
vc-kimi-code-seeded-v2-hr-payroll-django	0	22	29	0.0	0.0
vc-kimi-code-seeded-v2-legal-case-django	0	25	26	0.0	0.0
vc-kimi-code-seeded-v2-logistics-dispatch-fastapi	0	7	31	0.0	0.0
vc-kimi-code-seeded-v2-marketplace-commerce-fastapi	0	3	27	0.0	0.0
vc-kimi-code-seeded-v2-property-management-fastapi	0	9	30	0.0	0.0
vc-kimi-code-seeded-v2-support-desk-fastapi	0	5	28	0.0	0.0

Detection by severity

Severity	TP	FP	FN	Recall %
Critical	41	0	117	25.9
High	318	4	2530	11.2
Medium	48	1	918	5.0
Low	3	0	163	1.8

Detection by vulnerability class

CWE family	TP	FP	FN	Recall %
Command / OS Injection	75	0	61	55.1
HTTP Header Injection	1	0	1	50.0
Insecure Deserialization	20	1	28	41.7
Path Traversal	37	0	67	35.6
Code Injection / RFI	27	0	53	33.8
SQL Injection	47	3	107	30.5
Open Redirect	24	0	64	27.3
Cross-Site Scripting	42	1	164	20.4
Security Misconfiguration	22	0	182	10.8
XML External Entities	6	0	58	9.4
Server-Side Request Forgery	5	0	88	5.4
Other	94	0	1791	5.0
Hardcoded Credentials	10	0	206	4.6
Missing Authentication / Authorization	0	0	173	0.0
Broken Access Control / IDOR	0	0	232	0.0
Denial of Service	0	0	87	0.0
Sensitive Data Exposure	0	0	349	0.0
XPath Injection	0	0	17	0.0

Cost

Free

Total cost

Lines of code scanned

Successful runs

← Back to the leaderboard