Crucible Report

Level: hell  |  Generated: 7/1/2026, 9:15:31 AM  |  Branch: kenny-mode
42
/ 100
Poor
Crucible Score
64%
Seed Detection Rate
515
Seeds Tested
64%
Mutation Kill Rate
42
Crucible Score
🌿 Seed Results 329/515 detected
186 missed ⌄

By Language

js
93%
51/55
ts
81%
42/52
python
71%
37/52
java
67%
35/52
kotlin
64%
32/50
rust
64%
32/50
go
56%
29/52
php
54%
27/50
ruby
48%
24/50
csharp
38%
20/52

By Category

yaml_injection
100%
2/2
prototype_pollution
100%
10/10
race_condition
100%
5/5
yaml_deserialization
100%
3/3
eval_abuse
86%
12/14
unsafe_block
86%
6/7
hardcoded_secret
84%
67/80
insecure_crypto
83%
34/41
sql_injection
70%
44/63
deserialization
70%
16/23
hardcoded_url
67%
2/3
path_traversal
63%
33/52
xxe
57%
4/7
command_injection
56%
34/61
crypto_misuse
50%
2/4
log_injection
50%
1/2
xss
44%
28/63
ssrf
44%
18/41
open_redirect
38%
5/13
env_injection
33%
1/3
file_upload
20%
1/5
integer_overflow
20%
1/5
timing_attack
0%
0/3
mass_assignment
0%
0/5
SeedLangCategorySeverityExpected
✓ ruby/seed-044.rb ruby open_redirect high redirect_to params[:url] without validation — open redirect
✓ python/seed-036.py python insecure_crypto high DES cipher usage and AES-ECB mode with static key
✓ php/seed-017.php php xss high $_POST values echoed directly into HTML form — stored XSS vector
✓ ts/seed-032.ts typescript path_traversal high zip-slip path traversal via user-uploaded archive with unvalidated entry names
✓ go/seed-050.go go open_redirect medium Open redirect via http.Redirect with Referer header used as redirect destination
✓ js/seed-026.js javascript command_injection high command injection via child_process.exec in scheduled job
✓ java/seed-034.java java insecure_crypto high MD5 used for password hashing via MessageDigest
✓ kotlin/seed-032.kt kotlin path_traversal high Download path constructed from user-controlled filename without sanitization
✓ python/seed-052.py python yaml_injection critical yaml.load() without safe_load — RCE via !!python/object tags in YAML
✓ ts/seed-004.ts typescript hardcoded_secret critical hardcoded Stripe secret key and webhook secret in typed service
✓ js/seed-052.js javascript ssrf high SSRF via got/superagent with redirect following and user-controlled URL
✓ kotlin/seed-019.kt kotlin xss medium WebView evaluateJavascript with unsanitized user string
✓ rust/seed-044.rs rust crypto_misuse high MD5 crate used for password or data integrity hashing
✓ java/seed-048.java java ssrf high SSRF via URL.openConnection with user-supplied URL parameter
✓ csharp/seed-037.cs csharp insecure_crypto high SHA1 used for HMAC signing instead of SHA256 or higher
✓ java/seed-049.java java ssrf high SSRF via URL.openStream with user-controlled webhook URL
✓ csharp/seed-042.cs csharp deserialization critical Unsafe deserialization via DataContractSerializer reading from request body
✓ ruby/seed-002.rb ruby hardcoded_secret critical Hardcoded database password in database.yml equivalent or initializer
✓ go/seed-019.go go xss high XSS via w.Write injecting user input into inline JavaScript variable
✓ php/seed-018.php php xss high print_r or var_dump of user input rendered in HTML context
✓ js/seed-015.js javascript sql_injection critical SQL injection via bulk IN clause construction with user-supplied IDs
✓ python/seed-001.py python hardcoded_secret critical hardcoded AWS access key and secret key
✓ java/seed-044.java java xxe critical XXE via XMLReader without disabling external entities or DOCTYPE processing
✓ js/seed-047.js javascript eval_abuse high eval() inside setTimeout and setInterval with user-controlled string
✓ go/seed-042.go go open_redirect medium Open redirect via http.Redirect using user-supplied return URL after password reset
✓ java/seed-009.java java sql_injection critical SQL injection via string concatenation in executeQuery
✓ ts/seed-034.ts typescript insecure_crypto high MD5 used for password hashing in typed auth service
✓ csharp/seed-034.cs csharp insecure_crypto high MD5 used for password hashing via MD5.Create()
✓ java/seed-042.java java deserialization critical Unsafe deserialization in JMS message listener via ObjectMessage
✓ python/seed-049.py python deserialization critical pickle.load used with untrusted file upload and shelve with user-controlled key
✓ csharp/seed-009.cs csharp sql_injection critical SQL injection via string concatenation in SqlCommand
✓ python/seed-029.py python path_traversal high path traversal via open() with unvalidated user-supplied file path
✓ go/seed-034.go go insecure_crypto high MD5 used for password hashing via crypto/md5
✓ js/seed-046.js javascript eval_abuse high eval() used in JSON reviver to execute serialized function strings
✓ php/seed-029.php php path_traversal critical include() with user-supplied path — local file inclusion / RFI
✓ csharp/seed-045.cs csharp ssrf high SSRF via HttpClient.GetAsync with user-controlled endpoint URL
✓ csharp/seed-048.cs csharp xxe critical XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)
✓ ruby/seed-005.rb ruby hardcoded_secret high Hardcoded JWT secret and admin API token
✓ php/seed-003.php php hardcoded_secret critical Hardcoded AWS credentials and S3 configuration
✓ js/seed-014.js javascript sql_injection critical SQL injection via Sequelize literal() with user input
✓ kotlin/seed-038.kt kotlin insecure_crypto medium SHA-1 used for certificate pinning and signature verification
✓ js/seed-044.js javascript eval_abuse critical eval() called with user-controlled expression string
✓ go/seed-036.go go insecure_crypto high SHA1 used for HMAC signing and MD5 for file integrity verification
✓ go/seed-029.go go path_traversal high Path traversal via os.Open with user-supplied filename concatenated to base path
✓ ruby/seed-028.rb ruby command_injection high Kernel.system called with interpolated hostname for network diagnostics
✓ rust/seed-011.rs rust unsafe_block critical Unsafe foreign function interface call without input validation
✓ ruby/seed-021.rb ruby xss high ActionMailer HTML email built with unescaped user content
✓ ts/seed-048.ts typescript ssrf high SSRF via fetch with unvalidated user-supplied URL
✓ csharp/seed-033.cs csharp path_traversal high Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files
✓ js/seed-030.js javascript path_traversal high path traversal via user-controlled directory in readdir and readFileSync
✗ js/seed-018.js javascript xss high XSS via jQuery .html() with user-controlled data
✗ ruby/seed-032.rb ruby path_traversal high File.write to user-controlled destination path
✗ go/seed-045.go go ssrf high SSRF via http.Post with user-controlled webhook URL
✗ kotlin/seed-013.kt kotlin sql_injection critical ContentProvider query with raw selection argument built from user input
✗ csharp/seed-028.cs csharp command_injection critical Command injection via Process.Start with user-controlled email and report path
✗ go/seed-052.go go timing_attack medium Timing attack via bytes.Equal comparison of HMAC values instead of hmac.Equal
✗ java/seed-018.java java xss high XSS via JSP-style out.print with unescaped error message from request
✗ csharp/seed-022.cs csharp xss high XSS bypass via HtmlEncode applied to already-composed HTML string instead of individual inputs
✗ php/seed-041.php php file_upload critical Uploaded file stored with original filename preserving PHP extension
✗ csharp/seed-003.cs csharp hardcoded_secret critical Hardcoded JWT signing key embedded in authentication middleware
✗ python/seed-044.py python ssrf high SSRF via requests.get with unvalidated user-supplied URL
✓ js/seed-016.js javascript xss high XSS via innerHTML assignment with unsanitized user input
✓ rust/seed-014.rs rust unsafe_block high Use of unsafe to bypass borrow checker — potential use-after-free
✓ js/seed-012.js javascript sql_injection critical SQL injection in Express route via query parameter concatenation
✗ csharp/seed-050.cs csharp xxe critical XXE via XPathDocument loaded from request body without disabling DTD processing
✓ ruby/seed-025.rb ruby command_injection critical exec() with user-controlled command — replaces process, no return
✓ python/seed-015.py python sql_injection critical SQL injection via Django extra()/RawSQL() with user input
✓ kotlin/seed-029.kt kotlin path_traversal critical File path constructed from base + user input without normalization
✓ go/seed-006.go go hardcoded_secret high Hardcoded GitHub personal access token in REST client
✓ rust/seed-006.rs rust hardcoded_secret critical Hardcoded encryption key and IV in const literals
✓ rust/seed-013.rs rust unsafe_block critical Mutable aliasing via raw pointers — violates Rust's aliasing rules
✗ python/seed-022.py python xss medium XSS via FastAPI response with HTML and user-controlled query parameter
✓ go/seed-035.go go insecure_crypto high math/rand used instead of crypto/rand for security token generation
✗ java/seed-052.java java log_injection medium Log injection via logger.error with exception message containing user input
✓ php/seed-002.php php hardcoded_secret critical Hardcoded Stripe and PayPal API keys
✓ java/seed-045.java java xxe critical XXE via DocumentBuilderFactory without disabling external entity expansion
✓ ts/seed-018.ts typescript xss high XSS via innerHTML in typed DOM manipulation utility
✗ go/seed-026.go go command_injection critical Command injection via exec.Command passing user-supplied archive name to unzip
✓ csharp/seed-011.cs csharp sql_injection critical SQL injection in login via string interpolation in SqlCommand
✗ csharp/seed-007.cs csharp hardcoded_secret critical Hardcoded encryption key and IV stored as byte array constants
✗ ts/seed-047.ts typescript eval_abuse critical lodash template compilation with user-controlled template string (code execution)
✗ ts/seed-037.ts typescript insecure_crypto medium timing attack via string comparison of HMAC signatures
✗ ruby/seed-036.rb ruby mass_assignment critical attr_accessible :all or missing attr_protected — mass assignment in model
✓ rust/seed-001.rs rust hardcoded_secret critical Hardcoded AWS access key and secret in string literals
✓ ts/seed-013.ts typescript sql_injection high SQL injection via dynamic ORDER BY column name from user input
✓ rust/seed-004.rs rust hardcoded_secret critical Hardcoded Stripe and payment processor API keys
✓ js/seed-053.js javascript deserialization critical unsafe deserialization via node-serialize with exec gadget
✗ python/seed-027.py python command_injection high command injection via paramiko exec_command with user-controlled command string
✗ go/seed-051.go go timing_attack medium Timing attack via string equality comparison of API tokens instead of hmac.Equal
✓ go/seed-013.go go sql_injection critical SQL injection in IN clause via string join of user-supplied IDs
✗ csharp/seed-030.cs csharp path_traversal high Path traversal via Path.Combine without verifying result stays within base directory
✓ js/seed-039.js javascript prototype_pollution high prototype pollution via recursive merge of user-controlled object
✗ csharp/seed-027.cs csharp command_injection critical Command injection via cmd.exe with user-supplied network path
✗ php/seed-021.php php xss high User-controlled CSS class or style injected into page template
✓ java/seed-010.java java sql_injection critical SQL injection via string concatenation in login query
✓ rust/seed-010.rs rust unsafe_block critical std::mem::transmute misuse — reinterpret arbitrary bytes as typed reference
✓ java/seed-004.java java hardcoded_secret high Hardcoded Stripe API key in application constant
✓ js/seed-032.js javascript path_traversal high path traversal via ZIP extraction without path validation
✓ kotlin/seed-008.kt kotlin hardcoded_secret critical Hardcoded OAuth client secret and refresh token
✓ js/seed-010.js javascript sql_injection critical SQL injection via string concatenation in login query
✓ go/seed-005.go go hardcoded_secret critical Hardcoded Redis password and encryption key in configuration struct literal
✗ kotlin/seed-035.kt kotlin insecure_crypto high DES cipher used for encryption — weak key size (56-bit)
✓ python/seed-050.py python deserialization high marshal.loads and jsonpickle.decode used with untrusted data
✓ ts/seed-006.ts typescript hardcoded_secret critical hardcoded GitHub token and Slack webhook URL in typed integration config
✓ kotlin/seed-046.kt kotlin ssrf critical Ktor server acts as open proxy — fetches user-supplied URL server-side
✗ ts/seed-019.ts typescript xss high XSS via Express response with unsanitized template literal containing user input
✗ rust/seed-049.rs rust env_injection high Environment variable values reflected in HTTP response — credential leak
✗ php/seed-009.php php sql_injection critical mysqli_query with string concatenation — no prepared statements
✓ rust/seed-029.rs rust integer_overflow high Explicit unchecked arithmetic that wraps on overflow in release mode
✓ js/seed-019.js javascript xss high XSS via server-side template rendering with unsanitized variable
✗ csharp/seed-020.cs csharp xss high XSS via Razor @Html.Raw with user-controlled error message parameter
✓ php/seed-035.php php insecure_crypto high rand() used for security token generation — not cryptographically secure
✗ php/seed-020.php php xss high header Location redirect with user input reflected in HTML fallback
✗ ruby/seed-043.rb ruby ssrf critical RestClient.get with user-supplied URL — SSRF
✗ go/seed-049.go go open_redirect medium Open redirect via http.Redirect using Base64-decoded state parameter
✓ rust/seed-042.rs rust race_condition high Multiple threads access static mut without synchronization
✓ python/seed-013.py python sql_injection high SQL injection in FastAPI route via % operator in SQL string
✗ csharp/seed-010.cs csharp sql_injection critical SQL injection via string.Format building WHERE clause
✓ python/seed-034.py python insecure_crypto high MD5 used for password hashing
✓ go/seed-009.go go sql_injection critical SQL injection via fmt.Sprintf in db.Query building WHERE clause
✗ php/seed-048.php php open_redirect high header('Location') with unvalidated user-supplied URL — open redirect
✓ ts/seed-015.ts typescript sql_injection high SQL injection via Sequelize literal() with user-controlled search input
✓ kotlin/seed-049.kt kotlin hardcoded_url medium Hardcoded IP address and dev server URL with credentials embedded
✓ php/seed-042.php php file_upload high Extension check performed on full filename — bypassable with double extension
✓ js/seed-033.js javascript path_traversal medium path traversal via multer upload destination with user-controlled subfolder
✗ ruby/seed-034.rb ruby mass_assignment high params.permit(:all) or ActionController::Parameters without strong params
✓ rust/seed-019.rs rust command_injection critical Git command constructed with user-supplied repository URL
✓ python/seed-039.py python eval_abuse critical eval() called with user-controlled expression string
✗ ts/seed-052.ts typescript deserialization high unsafe deserialization via JSON.parse used to dynamically dispatch method calls
✗ go/seed-024.go go command_injection critical Command injection via exec.Command with user-controlled filename in ffmpeg call
✓ ts/seed-041.ts typescript prototype_pollution high prototype pollution via lodash _.merge or _.set with user-controlled path
✓ ts/seed-027.ts typescript command_injection high command injection in NestJS service using exec with user-provided report parameters
✗ csharp/seed-032.cs csharp path_traversal high Path traversal in file delete via Directory.Delete with user-controlled path
✗ php/seed-040.php php file_upload critical MIME type validated from user-supplied Content-Type header — bypassable
✗ csharp/seed-005.cs csharp hardcoded_secret critical Hardcoded Azure Storage connection string containing account key
✗ rust/seed-017.rs rust command_injection critical User input interpolated into shell command string passed to sh -c
✓ java/seed-037.java java insecure_crypto high SHA-1 used for HMAC signature and MD5 for file integrity check
✓ rust/seed-038.rs rust ssrf critical DNS rebinding-vulnerable health check using user-supplied host
✓ ts/seed-005.ts typescript hardcoded_secret high hardcoded SendGrid API key and SMTP credentials in typed mailer service
✗ python/seed-024.py python command_injection critical command injection via subprocess.call with shell=True and user input
✗ kotlin/seed-009.kt kotlin sql_injection critical Raw SQL query with string interpolation, no parameterization
✗ python/seed-017.py python xss high XSS via Flask response with unsanitized user input in HTML string
✓ go/seed-018.go go xss high XSS via io.WriteString writing raw user input into HTTP response
✓ go/seed-023.go go command_injection critical Command injection via exec.Command with user-controlled string passed to shell
✓ kotlin/seed-033.kt kotlin path_traversal critical Intent-supplied file path used directly for file read without validation
✓ csharp/seed-038.cs csharp insecure_crypto high AES-ECB mode used for encryption (no IV, leaks data patterns)
✗ ruby/seed-022.rb ruby xss medium ERB template rendered with user string directly substituted
✓ python/seed-035.py python insecure_crypto high SHA1 used for password hashing and random.random() for token generation
✓ php/seed-004.php php hardcoded_secret critical Hardcoded JWT secret and encryption key
✗ ruby/seed-040.rb ruby ssrf critical HTTParty.get with user-supplied URL — SSRF to internal services
✓ ts/seed-029.ts typescript path_traversal high path traversal via unvalidated user path in fs.readFile
✗ python/seed-028.py python command_injection critical command injection via subprocess.run with shell=True and user-controlled git operation
✓ js/seed-025.js javascript command_injection critical command injection via spawn shell:true with user input
✗ rust/seed-020.rs rust command_injection high ffmpeg command built from user-controlled filenames without sanitization
✗ go/seed-046.go go ssrf high SSRF via http.NewRequest with user-controlled base URL for metadata fetch
✓ php/seed-036.php php insecure_crypto high mcrypt_encrypt with weak DES algorithm and hardcoded key
✓ js/seed-003.js javascript hardcoded_secret critical hardcoded JWT secret used to sign tokens
✓ php/seed-034.php php insecure_crypto critical md5() used for password hashing — broken, no salt
✗ ruby/seed-037.rb ruby mass_assignment high slice(:all) or no-arg permit! allowing all user-supplied attributes
✓ kotlin/seed-022.kt kotlin xss medium allowUniversalAccessFromFileURLs enables cross-origin reads from file:// URLs
✗ php/seed-027.php php command_injection critical popen() pipe to shell with user-supplied grep pattern
✗ python/seed-040.py python eval_abuse critical exec() called with user-controlled code string
✓ js/seed-029.js javascript path_traversal high path traversal via unvalidated user-supplied file path in fs.readFile
✓ java/seed-032.java java path_traversal high Path traversal in file delete endpoint with user-controlled filename
✗ ruby/seed-012.rb ruby sql_injection critical Raw SQL executed via connection.execute with user input
✗ csharp/seed-021.cs csharp xss medium XSS via Response.Write injecting user input into JavaScript variable
✗ csharp/seed-017.cs csharp xss high XSS via Response.Write with search query reflected into HTML
✓ js/seed-036.js javascript insecure_crypto high DES/RC4 weak cipher and static IV reuse in AES-ECB mode
✓ rust/seed-041.rs rust race_condition critical Unsafe impl Send for type containing raw pointer — data race
✓ ts/seed-001.ts typescript hardcoded_secret critical hardcoded AWS credentials in typed config object
✓ kotlin/seed-017.kt kotlin xss high addJavascriptInterface exposes arbitrary Java object to WebView JavaScript
✓ ruby/seed-019.rb ruby xss medium User content embedded in JSON output that is then eval()d client-side
✓ go/seed-025.go go command_injection critical Command injection via strings.Split on user input passed to exec.Command
✓ ruby/seed-049.rb ruby yaml_deserialization critical YAML.load on file contents from user-supplied path — RCE via Psych gadget
✓ java/seed-015.java java sql_injection critical SQL injection via IN clause built with user-supplied comma-separated IDs
✗ ts/seed-020.ts typescript xss medium XSS via Next.js page that renders query param directly into dangerouslySetInnerHTML
✗ go/seed-037.go go insecure_crypto high DES encryption used for sensitive data (56-bit key, broken algorithm)
✗ csharp/seed-013.cs csharp sql_injection critical SQL injection in stored procedure exec via string concatenation
✓ python/seed-048.py python deserialization critical pickle.loads used with untrusted data — arbitrary code execution
✓ ts/seed-038.ts typescript insecure_crypto high PBKDF2 with low iteration count and SHA1, plus MD5 data integrity check
✓ kotlin/seed-036.kt kotlin insecure_crypto high Math.random() used for security-sensitive token generation
✓ ruby/seed-006.rb ruby hardcoded_secret critical Hardcoded OAuth client secret and social login credentials
✓ rust/seed-036.rs rust ssrf critical URL constructed from user-supplied hostname and path — SSRF
✗ ruby/seed-026.rb ruby command_injection critical Open3.capture2 with shell string — user input in format string
✓ js/seed-049.js javascript ssrf high SSRF via http.get with unvalidated user-supplied URL
✓ ts/seed-009.ts typescript sql_injection critical SQL injection via TypeORM query() with string concatenation
✓ kotlin/seed-001.kt kotlin hardcoded_secret critical Hardcoded Google Maps API key in source code
✓ csharp/seed-052.cs csharp open_redirect medium Open redirect via LocalRedirect with user-controlled URL bypassing local check
✗ ruby/seed-046.rb ruby open_redirect medium Regex-based redirect validation bypassable with CRLF or subdomain trick
✓ js/seed-027.js javascript command_injection critical command injection via execa with unsanitized filename
✓ python/seed-009.py python sql_injection critical SQL injection via string formatting in cursor.execute
✓ csharp/seed-029.cs csharp path_traversal high Path traversal via File.ReadAllText with unvalidated user-supplied filename
✗ java/seed-030.java java path_traversal high Path traversal via FileInputStream constructed from user-supplied path
✓ ts/seed-021.ts typescript xss high XSS via Vue.js v-html directive with user-supplied content
✗ java/seed-017.java java xss high XSS via response.getWriter writing unescaped search query into page
✓ js/seed-009.js javascript sql_injection critical SQL injection via string concatenation in user query
✓ java/seed-001.java java hardcoded_secret critical Hardcoded database password in constant
✓ kotlin/seed-006.kt kotlin hardcoded_secret high Hardcoded JWT secret and admin password
✗ go/seed-031.go go path_traversal high Path traversal via filepath.Join without verifying result is within base directory
✗ js/seed-020.js javascript xss medium XSS via eval of user-controlled JSON embedded in script tag
🧬 Mutation Kill Rate 64%
330/515 killed ⌄
Kill Rate
64%
330/515
Survival Rate
36%
185/515
SeedMutations AppliedResult
✓ ruby/seed-044.rb Killed
✓ python/seed-036.py Killed
✓ php/seed-017.php string_split_concat Killed
✓ ts/seed-032.ts Killed
✓ go/seed-050.go Killed
✓ js/seed-026.js string_split_concat Killed
✓ java/seed-034.java Killed
✓ kotlin/seed-032.kt Killed
✓ python/seed-052.py Killed
✓ ts/seed-004.ts string_split_concat Killed
✓ js/seed-052.js Killed
✓ kotlin/seed-019.kt Killed
✓ rust/seed-044.rs Killed
✓ java/seed-048.java Killed
✓ csharp/seed-037.cs Killed
✓ java/seed-049.java Killed
✓ csharp/seed-042.cs Killed
✓ ruby/seed-002.rb string_split_concat Killed
✓ go/seed-019.go Killed
✓ php/seed-018.php Killed
✓ js/seed-015.js Killed
✓ python/seed-001.py Killed
✓ java/seed-044.java Killed
✓ js/seed-047.js string_split_concat operator_flip_eq Killed
✓ go/seed-042.go Killed
✓ java/seed-009.java Killed
✓ ts/seed-034.ts Killed
✓ csharp/seed-034.cs Killed
✓ java/seed-042.java Killed
✓ python/seed-049.py Killed
✓ csharp/seed-009.cs Killed
✓ python/seed-029.py Killed
✓ go/seed-034.go Killed
✓ js/seed-046.js string_split_concat operator_flip_eq Killed
✓ php/seed-029.php string_split_concat Killed
✓ csharp/seed-045.cs Killed
✓ csharp/seed-048.cs Killed
✓ ruby/seed-005.rb Killed
✓ php/seed-003.php string_split_concat Killed
✓ js/seed-014.js string_split_concat Killed
✓ kotlin/seed-038.kt Killed
✓ js/seed-044.js string_split_concat Killed
✓ go/seed-036.go Killed
✓ go/seed-029.go Killed
✓ ruby/seed-028.rb Killed
✓ rust/seed-011.rs Killed
✓ ruby/seed-021.rb Killed
✓ ts/seed-048.ts Killed
✓ csharp/seed-033.cs Killed
✓ js/seed-030.js Killed
✗ js/seed-018.js Survived
✗ ruby/seed-032.rb Survived
✗ go/seed-045.go Survived
✗ kotlin/seed-013.kt Survived
✗ csharp/seed-028.cs Survived
✗ go/seed-052.go Survived
✗ java/seed-018.java Survived
✗ csharp/seed-022.cs string_split_concat Survived
✗ php/seed-041.php string_split_concat Survived
✗ csharp/seed-003.cs Survived
✗ python/seed-044.py Survived
✓ js/seed-016.js string_split_concat Killed
✓ rust/seed-014.rs Killed
✓ js/seed-012.js hex_string_encoding Killed
✗ csharp/seed-050.cs Survived
✓ ruby/seed-025.rb Killed
✓ python/seed-015.py Killed
✓ kotlin/seed-029.kt Killed
✓ go/seed-006.go Killed
✓ rust/seed-006.rs Killed
✓ rust/seed-013.rs Killed
✗ python/seed-022.py Survived
✓ go/seed-035.go Killed
✗ java/seed-052.java Survived
✓ php/seed-002.php Killed
✓ java/seed-045.java Killed
✓ ts/seed-018.ts Killed
✗ go/seed-026.go Survived
✓ csharp/seed-011.cs Killed
✗ csharp/seed-007.cs Survived
✗ ts/seed-047.ts string_split_concat Survived
✗ ts/seed-037.ts string_split_concat operator_flip_eq Survived
✗ ruby/seed-036.rb Survived
✓ rust/seed-001.rs Killed
✓ ts/seed-013.ts Killed
✓ rust/seed-004.rs Killed
✓ js/seed-053.js string_split_concat Killed
✗ python/seed-027.py Survived
✗ go/seed-051.go Survived
✓ go/seed-013.go Killed
✗ csharp/seed-030.cs Survived
✓ js/seed-039.js operator_flip_eq Killed
✗ csharp/seed-027.cs Survived
✗ php/seed-021.php Survived
✓ java/seed-010.java Killed
✓ rust/seed-010.rs Killed
✓ java/seed-004.java Killed
✓ js/seed-032.js Killed
✓ kotlin/seed-008.kt Killed
✓ js/seed-010.js Killed
Generated by Thuban Crucible — The Fire Test for Security Scanners