Six of nine caught. Zero false positives.

These are the most interesting rows in the table. Each of the three is reachable with a regex that would also fire on correct code — which is exactly the trade this benchmark exists to refuse. Here is what each one really needs.

This section listed four misses when the benchmark was first published. The read-modify-write race was named there as the most rule-able of them and the next one we intended to close. It shipped as read-modify-write-race and now sits in the caught half of the table above — moved because it was closed, not because the bar moved.

Two of the three — IDOR and missing authorization — were named here as the reason a dataflow substrate sat at the top of the engine roadmap. That substrate has since shipped as the hosted Route Authorization Graph, and this paragraph is the update it owes you. The table above is unchanged, and the count is still 6 of 9. The nine rows record what the deterministic rule pack does on this corpus, and the authorization graph is not a rule-pack rule: it is a hosted-only pass, off for every scan type except a security scan, and it runs no part of the CLI.

What it changes is the answer to the question, not the number in the table. Missing authorization (CWE-862) is detected today, and the shape it is tested against is this corpus’s bug 9 exactly — a mutating POST whose write happens in an imported helper, reported cross-file at HIGH with the entry and the write it reaches both named. IDOR (CWE-639) is detected today as well, but it does not fire on bug 1 of this fixture, and it will not. Two structural reasons, both of them permanent properties of this corpus rather than bugs waiting to be fixed: the analysis is intra-entry, and bug 1’s query lives in invoices.ts, a helper the route calls rather than the handler itself; and the tenancy oracle is read from a Prisma or Drizzle schema, which a two-file fixture does not have. A repository with no machine-readable schema produces no IDOR finding ever, and the pass records SKIPPED rather than a clean result, so a report cannot claim a class nothing checked. The row stays a miss because on this fixture it is one.

Where the detector does fire is a repository that has both — a framework entry convention and a schema. Its measured result, its corpus, and the five things it cannot see are on the code audit page. What this page will not do is quietly restate 6 of 9 as a better number because a different pass, in a different product surface, closed a class this fixture cannot exercise.

A benchmark you cannot re-run is marketing. Both corpus files are printed here complete — 52 lines total. Drop them into a repository at these paths and run codetruss review --task “Benchmark reproduction”.

The free local CLI reports five security findings — lines 13, 21, 26, 39, and 49 of src/lib/invoices.ts — and nothing in src/app/api/invoices/route.ts. The sixth row of the table above, the read-modify-write race at invoices.ts:31, is produced by read-modify-write-race, which runs only in the hosted audit. So 6 of 9 is the hosted rule-pack number, and 5 of 9 is what a local run on your own machine will show you. If you want the sixth on the same corpus, it takes a hosted scan; §09 has the rest of that split.

import { db } from './db'

// BUG 1 (IDOR): no orgId filter — any user reads any org's invoice
export async function getInvoice(invoiceId: string) {
  return db.invoice.findUnique({ where: { id: invoiceId } })
}

// BUG 2 (N+1): query inside a loop
export async function listWithCustomers(orgId: string) {
  const invoices = await db.invoice.findMany({ where: { orgId } })
  const out = []
  for (const inv of invoices) {
    const customer = await db.customer.findUnique({ where: { id: inv.customerId } })
    out.push({ ...inv, customer })
  }
  return out
}

// BUG 3 (floating promise): not awaited — write silently lost on error
export function recordAudit(orgId: string, action: string) {
  db.auditLog.create({ data: { orgId, action } })
}

// BUG 4 (mass assignment): spreads raw client input into an update
export async function updateInvoice(id: string, body: Record<string, unknown>) {
  return db.invoice.update({ where: { id }, data: { ...body } })
}

// BUG 5 (race): read-modify-write without a transaction
export async function incrementBalance(id: string, amount: number) {
  const inv = await db.invoice.findUnique({ where: { id } })
  return db.invoice.update({ where: { id }, data: { balance: inv.balance + amount } })
}

// BUG 6 (swallowed error): empty catch hides failures
export async function sendReceipt(id: string) {
  try {
    await fetch(`https://mail.example.com/send?invoice=${id}`)
  } catch {}
}

// BUG 7 (off-by-one): page 1 skips a record
export async function page(orgId: string, pageNum: number, size = 20) {
  return db.invoice.findMany({ where: { orgId }, skip: pageNum * size, take: size })
}

// BUG 8 (loose equality): '0' == 0 is true, so zero-amount passes
export function isPaid(amount: unknown) {
  return amount == 0
}

import { getInvoice, updateInvoice } from '@/lib/invoices'

// BUG 9 (missing authz): no session/role check on a mutating route
export async function POST(req: Request) {
  const body = await req.json()
  return Response.json(await updateInvoice(body.id, body))
}

export async function GET(req: Request) {
  const { searchParams } = new URL(req.url)
  return Response.json(await getInvoice(searchParams.get('id')!))
}