Results
Every corpus, including the ones we score badly on.
A vendor quoting one number has chosen that number. These are all of them, each with the date it was measured, the engine commit behind it and what it cost in requests. Where we are weak it says so — you would find out anyway.
Detection, by corpus
Two of these are public corpora we did not write. One is ours and is marked as such.
The bottom bar is the one to look at. OWASP VulnerableApp is graded by its own harness and we reach 102 of 154 — most of the gap sits behind scripted navigation and login walls the crawler does not yet reach.
Show as a table
| Corpus | Detected | Total | Share |
|---|---|---|---|
| WAVSEP true positives | 1210 | 1210 | 100.0% |
| Crawl Maze | 85 | 85 | 100.0% |
| Crawler traps | 10 | 10 | 100.0% |
| OWASP VulnerableApp | 102 | 154 | 66.2% |
What the false-positive traps did
WAVSEP ships 44 cases that look vulnerable and are not. Recall means nothing without this number beside it.
One was reported wrongly — an LFI look-alike. The disputed case is one where we believe the corpus’s own answer key is wrong; it is still counted against us rather than argued away.
WAVSEP, by category
Bar length is the number of cases, so the corpus’s own weighting is visible. Every one detects.
measured 2026-09-09 · engine a2b55e7 · tree clean · 71,966 requests · Linux 6.8.0-139-generic x86_64
How to check any of this
Every figure comes from a JSON file the harness writes itself, with the
provenance stamped in by the harness rather than typed by hand. The corpora
are public: WAVSEP is zaproxy/wavsep; Crawl Maze and
VulnerableApp are on GitHub. Run them against whatever you like and compare.