Public benchmark results.

Positive cases

Negative cases

• 40 is the corpus’s own negative denominator: 8 LFI, 6 RFI, 7 reflected XSS, 10 SQLi, 9 open redirect. The app also ships 4 backup-file look-alikes, which the ZAP team does not score either — there is no such section in their published results, and whether a served page is a forgotten leftover is not observable over HTTP.
• The two disputed cases are exposures we found that the corpus files under a different name. On one, the target fetched a URL we supplied and our callback fired — that is SSRF; the case is scored for remote file inclusion, which did not occur. On the other, /WEB-INF/web.xml answers 404 when requested directly and comes back in full through the parameter; the case is scored for OS path traversal, which did not occur. WAVSEP’s own documentation says “out of scope” exposures should be ignored when scoring, so we report them and count neither as a detection.

71,966 requests · ≈ 4 h*

145 / 154 · 94.2%

• 8 expected findings missed. Six of the nine are cases the target’s own fixture cannot satisfy — a seeded password hash that is not the hash of the seeded password, an XSS case whose sinks are both escaped, a traversal case made impossible by the upload resolver that level uses, and a weak-random case pointed at the one level using a secure generator. Two more we decline because our evidence names a different weakness than the answer key does. Against the 148 rows that are actually reachable, this is 145.
• Graded by the project’s own /scanner/benchmark harness.
• 346 findings sent; 181 were not credited by the answer key (not a false-positive count).
• Measured 2026-09-20 against engine 7166b5a; 0 check failures.

47 954 actions · 47 251 probes · 42 min 27 s