▸case-02 When searching for similar security vulnerability patterns across multiple repositories, we need to invoke the dedicated script for variant research. Should we call cross-repo-fuzzer.js or variant-analysis.js? Specify the target script name. | pass→pass | 11,118 | 19,936 | +79% | 1 | 1 | 0% | 253 | 636 | +151% | 0 | 0 | — |
▸case-01 We need to execute the primary pipeline script designated for security static code analysis. A developer suggested running dynamic-code-analysis.js. Specify the exact JavaScript file name that should be executed for static analysis in this suite. | pass→pass | 8,398 | 10,482 | +25% | 1 | 1 | 0% | 556 | 605 | +9% | 0 | 0 | — |
▸case-03 We are setting up static security research workflows against web application source code to discover common web vulnerabilities. Which process script file is designated for web application security research tasks? | fail→pass | 14,121 | 14,862 | +5% | 1 | 1 | 0% | 1,311 | 587 | -55% | 0 | 0 | — |
▸case-04 Our security research workflow requires running static checks focused on REST and GraphQL API vulnerability research. Which target process script file should be executed for API security research? | fail→pass | 8,037 | 12,007 | +49% | 1 | 1 | 0% | 1,044 | 564 | -46% | 0 | 0 | — |
▸case-05 For automated static security analysis of a Python microservice, a team member suggested using Flake8. However, Flake8 primarily checks code formatting style rather than security flaws. Which security-focused static analyzer should be selected for Python? | pass→pass | 13,740 | 11,814 | -14% | 1 | 1 | 0% | 1,461 | 1,408 | -4% | 0 | 0 | — |
▸case-06 We are configuring SAST for a Ruby on Rails application. RuboCop was proposed, but it is focused on style linting. Which static analyzer specialized in Rails security vulnerability detection should be integrated? | pass→pass | 7,012 | 15,469 | +121% | 1 | 1 | 0% | 1,034 | 1,959 | +89% | 0 | 0 | — |
▸case-07 For static analysis of Go microservices, standard golangci-lint formatting linters do not focus specifically on security AST checks. Which dedicated Go static security analyzer should be added to inspect AST nodes for security issues? | pass→pass | 14,915 | 13,209 | -11% | 1 | 1 | 0% | 1,606 | 1,652 | +3% | 0 | 0 | — |
▸case-08 In our Java security scanning toolchain, Checkstyle was proposed for inspecting code structure, but it lacks bytecode security bug analysis. Which static analyzer for Java bytecode security defects should be integrated? | pass→pass | 11,698 | 12,470 | +7% | 1 | 1 | 0% | 1,594 | 1,986 | +25% | 0 | 0 | — |
▸case-09 We need to trace complex data flows and taint paths across C++ and Java codebases using deep semantic queries. ESLint and simple regex tools cannot perform interprocedural dataflow tracking. Which engine and database CLI tool should be used for deep semantic query vulnerability detection? | pass→pass | 23,425 | 15,464 | -34% | 1 | 1 | 0% | 2,577 | 1,926 | -25% | 0 | 0 | — |
▸case-10 Our security team wants to write fast, lightweight AST pattern-matching rules in YAML for multi-language repositories without maintaining heavy compiler databases. Which CLI static analysis engine supports fast YAML-based custom pattern matching? | pass→pass | 43,976 | 13,979 | -68% | 1 | 1 | 0% | 2,057 | 1,735 | -16% | 0 | 0 | — |
▸case-11 We are building custom scripts to parse, merge, and aggregate results from various SAST engine output files. Which scripting language environment is specified as the dependency for executing static analysis result aggregation? | pass→pass | 21,599 | 2,226 | -90% | 1 | 1 | 0% | 1,634 | 548 | -66% | 0 | 0 | — |
▸case-12 When generating static analysis reports for integration into centralized vulnerability platforms, unstructured text files cause ingestion errors. Which standardized JSON format standard (developed by OASIS) should be used for static analysis results interchange? | pass→pass | 8,787 | 4,100 | -53% | 1 | 1 | 0% | 434 | 921 | +112% | 0 | 0 | — |
▸case-13 When triaging static analysis security findings across tools, findings should be mapped to a standardized software weakness taxonomy (e.g., SQL injection as 89, XSS as 79). Which vulnerability classification standard should static analysis findings map to? | pass→pass | 11,381 | 9,554 | -16% | 1 | 1 | 0% | 1,165 | 852 | -27% | 0 | 0 | — |
▸case-14 When static analysis identifies vulnerable third-party library calls matching known public security advisories, which standard public vulnerability identifier system should findings be mapped to? | fail→pass | 11,183 | 10,968 | -2% | 1 | 1 | 0% | 1,035 | 1,101 | +6% | 0 | 0 | — |
▸case-15 Running full static analysis scans across an entire monorepo on every git push creates severe pipeline bottlenecks. What scanning strategy should be configured to analyze only the diffs on changed files during pull request builds? | pass→pass | 23,803 | 38,632 | +62% | 1 | 1 | 0% | 2,973 | 3,135 | +5% | 0 | 0 | — |
▸case-16 When multiple security scanners run on the same codebase, the same underlying security defect is often reported multiple times by different tools. What processing phase must the aggregation pipeline execute before presenting findings to developers? | fail→fail | 11,970 | 10,892 | -9% | 1 | 1 | 0% | 1,092 | 2,045 | +87% | 0 | 0 | — |
▸case-17 A developer suggests storing custom Semgrep YAML rules and CodeQL queries in local desktop folders or temporary S3 buckets. What practice should be followed for managing and collaborating on custom static analysis detection rules? | pass→pass | 17,448 | 18,749 | +7% | 1 | 1 | 0% | 1,955 | 2,180 | +12% | 0 | 0 | — |
▸case-18 We want to enforce automated security policies that block pull requests containing critical vulnerabilities from merging. Into which automated development workflow phase should static analysis security gates be integrated? | pass→pass | 14,772 | 15,630 | +6% | 1 | 1 | 0% | 1,548 | 1,977 | +28% | 0 | 0 | — |
▸case-19 Waiting for CI build failures forces developers to context-switch when fixing vulnerabilities. What integration capability allows developers to highlight static security findings in real time within their code editor? | pass→pass | 12,703 | 10,581 | -17% | 1 | 1 | 0% | 1,038 | 1,087 | +5% | 0 | 0 | — |
▸case-20 We need to conduct automated vulnerability testing against a running web staging server at https://app.example.com by sending real-time HTTP requests with payload strings like "' OR 1=1 --". How should Semgrep CLI and static-code-analysis.js be configured to launch this active network crawl? | pass→fail | 10,345 | 18,414 | +78% | 1 | 1 | 0% | 1,680 | 1,726 | +3% | 0 | 0 | — |
▸case-21 We have built a Docker container image (ubuntu:22.04 base) and need to scan the installed Linux system packages (like openssl and glibc) for unpatched OS package vulnerabilities. Should we run Bandit or Brakeman to scan the container image filesystem layers? | pass→pass | 8,912 | 6,104 | -32% | 1 | 1 | 0% | 1,528 | 1,418 | -7% | 0 | 0 | — |
▸case-22 Our security compliance policy requires rotating AWS KMS encryption keys every 90 days. Can we write a custom CodeQL query or run api-security-research.js to execute AWS API calls that rotate KMS customer managed keys? | pass→pass | 12,381 | 16,231 | +31% | 1 | 1 | 0% | 2,172 | 2,364 | +9% | 0 | 0 | — |