The 2026-10-23 commit 68d867332e14eba3f6a57ae52d82d5c96c2d92a9 in nealbridges/vulnhunter added an OWASP reference corpus for benchmarking and pre-validation. This repository is a maintained fork of an agentic AI security scanner that finds vulnerabilities, proves them with runnable PoCs, and fixes them in a test-first manner. This change puts six known vulnerabilities from Juice Shop, WebGoat, and NodeGoat into harness/local_harness/benchmark/ground_truth/ and pins each entry to a public commit. The basis for the change is the GitHub commit page: https://github.com/nealbridges/VulnHunter/commit/68d867332e14eba3f6a57ae52d82d5c96c2d92a9.
The reference corpus is the data used to compare the scanner's results against known vulnerabilities. The previous EXAMPLE.json used placeholder commits, so a new benchmark could fail at the cloning stage, and there was no format check, so invalid data could surface as a KeyError in the middle of execution. Now the runner reads only *.json files and does not load EXAMPLE.json or *.json.template. Before it starts cloning, it checks the required fields, the finding_id, which must be unique across the whole corpus, and the format of the GitHub tree URL. The documentation also now advises prefixing the finding_id of new entries with the app name.
What this commit provides is executable reference data and input validation. How many of the six the scanner finds, or what score it produces in the benchmark, is not stated in the FACTS. Since the corpus is deliberately limited to three intentionally vulnerable apps, it is closer to a foundation for starting the comparison than a result showing detection performance across diverse repositories.