AppSecBench Dataset Card

Dataset Summary

AppSecBench is an original benchmark of 406 vulnerable/secure code pairs spanning 12 programming languages, 18 frameworks, 34 vulnerability classes, and 5 difficulty levels. Each record is a self-contained evaluation case: a vulnerable snippet, its secure counterpart, an exploit sketch, and the "ground truth" a detector/model is expected to produce (CWE, OWASP, severity, CVSS 3.1, explainability, fix, and false-positive/false-negative priors).

The dataset supports measuring whether an LLM or security tool can detect, classify, explain, score severity, recommend a fix, and generate secure code for real-world application-security weaknesses — including modern AI/LLM risks (prompt injection, RAG, MCP, agent security) and infrastructure misconfigurations.

Data Files

dataset/
  train.jsonl       (434 records)
  validation.jsonl  (69 records)
  test.jsonl        (69 records)

Supported Tasks

Task	Input	Expected output
Vulnerability detection	vulnerable_code	vulnerability flagged + location
CWE/OWASP mapping	code	expected_cwe / expected_owasp
Severity estimation	code	expected_severity + expected_cvss_score
Exploit explanation	code	exploitability_explanation
Secure fix / secure code gen	code	expected_secure_code
False-positive / false-negative analysis	code	expected_false_positive_probability / expected_false_negative_probability

Languages & Frameworks

Python, Java, JavaScript, TypeScript, Go, Rust, PHP, C#, Kotlin, Swift, C, C++ (code); plus Infrastructure-as-Code in YAML / Dockerfile / Bash. Frameworks: Flask, FastAPI, Django, Spring Boot, Express, NestJS, Next.js, Laravel, ASP.NET Core, Gin, Echo, Fiber, Android, iOS.

Data Fields

Each record is a JSON object (see README.md for the field list). metadata carries difficulty, category, cwe, owasp, owasp_api, owasp_llm, cvss_vector, cvss_score, source, license, and schema_version.

Distribution (v1.1.0)

• 17 languages, 18 frameworks, 27 unique CWEs, 9 unique OWASP Top-10 (2021) classes, 34 vulnerability types.
• Difficulty: Beginner, Intermediate, Advanced, Expert, Real-world enterprise.
• Source type: synthetic for all records (original, non-derived).
• Full per-dimension counts: statistics/summary.txt and statistics/statistics.md.

Methodology

Records are generated deterministically (scripts/build.py, seed=42) from an original catalog (scripts/vuln_catalog.py) and per-language generators (scripts/generators.py). CVSS 3.1 base scores are computed from the official FIRST formulas (scripts/cvss.py). See docs/methodology.md.

Quality & Validation

An automated QA suite (scripts/validate.py) enforces: JSON validity, no duplicate IDs, required field presence, enum conformance, CWE/OWASP/CVSS format + recomputation consistency, label consistency vs the catalog, vulnerable_code != secure_code, reference well-formedness, and real syntax/compile checks. Result for v1.1.0: PASS (0 errors) over 572 records. Report: validation/validation_report.md.

Intended Uses

• Evaluating and comparing LLMs on secure-code understanding.
• Benchmarking SAST / SCA / secret-scanning / IaC-scanning tools.
• Training and fine-tuning secure-coding assistants (with proper licensing).
• Academic reproducible experiments in application security.

Limitations & Out-of-Scope

• Snippets are minimal/synthetic, not full applications; they isolate one weakness at a time.
• Some languages are checked with heuristic balance (not compiled) when no toolchain is present.
• The benchmark measures recognition/explanation, not end-to-end offensive capability.
• Not a substitute for manual security review or threat modeling.

See docs/LIMITATIONS.md and docs/INTENDED_USES.md.

Ethical Considerations & Responsible Disclosure

docs/ETHICAL_CONSIDERATIONS.md and docs/RESPONSIBLE_DISCLOSURE.md. The vulnerable code is educational, synthetic, and non-weaponized.

Licensing

MIT. Code snippets are original and provided for defensive use.

Citation (BibTeX)

@dataset{tasdelen2026appsecbench,
  title  = {AppSecBench: A Comprehensive Benchmark Dataset for Application Security Evaluation, Secure Code Review, AI Security Research, LLM Evaluation, and Secure Software Engineering},
  author = {Taşdelen, İsmail},
  year   = {2026},
  version= {1.1.0},
  publisher = {Hugging Face}
}