Loading report…
← nittim
← nittimshared report
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)[](https://nittim.com)Material risks remain. Remediate before relying on this in production.Real risks remain. Fix these before you rely on this for real users.Fix these risks before shipping to real users.
This verdict covers the 3% of your repository we read — see what we didn’t read below.This result is based on the 3% of your project’s code we actually read — see what we didn’t read below.Covers 3% of your repo — see what we didn’t read below.
This audit read 220 of your 5725 files — the ones most likely to hurt you first. The snapshot was truncated — this audit's size limit was reached.
The scores and findings above cover only those files. The rest of the repository hasn’t been audited yet. The denominator counts every file in the repository — images, generated output, vendored and build directories included.
220 of 5725 files were audited. This audit's size or file-count limit was reached, so some source and configuration files were left unread. The denominator counts every file in the repository — images, generated output, vendored and build directories included.
This audit's size limit was reached before it read the whole repository. The verdict and every score on this report were computed from what it did read — read them as evidence about that sample, not a clean bill of health for the rest.
The AI-generated likelihood estimate is based on 3% of repository files (220/5725) — read it cautiously. The audited files were selected by priority, but a large portion of the repository was not seen.
OWASP Benchmark for Java (BenchmarkJava) is the well-known, OWASP-maintained test suite whose PURPOSE is to be a fully runnable, deliberately and exhaustively vulnerable Java web application used to score SAST/DAST/IAST tools. This context is decisive: the thousands of injection, weak-crypto, cookie, and trust-boundary flaws in the test cases are the product's intended payload, not defects, and must not be graded as production security bugs. The audited snapshot (220 of 5725 files) is dominated by machine-generated per-test-case HTML scaffolding (uniform templates with 'someSecret' placeholder values — not real credentials), plus build/CI/container config. The deterministic scanners found no hardcoded secrets and four MODERATE, advisory-only dependency issues (commons-lang 2.6, bouncycastle 1.70). Real, in-scope hygiene findings are limited and minor: outdated declared dependencies, a throwaway Docker image using ubuntu:latest with a hardcoded bench:bench OS account, and a 'changeit' TLS keystore password in the deploy profile. The dominant operational risk is not a code defect but a deployment-boundary one: this application is intentionally exploitable and must never be exposed to an untrusted network. CI/CD is comparatively mature (CodeQL security-extended, Spotless, Maven package). There is no novel proprietary IP to protect — the project is public by design and its methods are openly documented. For its intended use as a local/CI benchmarking harness it is fit for purpose; it is categorically NOT a template for a production-safe web app.
pom.xmlcargo plugin config in 'deploy' and 'deploywcontrast' profiles: '<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>' with keystoreFile '${project.basedir}/.keystore'.Weighted blend of 4 dimensions → ~67/100. Dimensions are weighted by importance (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting and precise scoring are proprietary, while the verdict is computed on exact internal values.4 categories combine into ~67/100. Some categories count for more than others (Security and Privacy count the most). The published numbers are approximate; nittim's exact math is kept private, while the verdict itself is worked out from the exact internal numbers.Weighted blend of 4 dimensions → ~67/100 (Security and Privacy weigh heaviest). Published figures are approximate; nittim's exact weighting is proprietary. The verdict runs on exact internal values.
IP Protection is an independent IP-defensibility lens and is excluded from this blend.IP Protection (checking whether your ideas are exposed) is judged separately and isn’t
part of this combined number.IP Protection is judged separately, excluded from this blend.
Scores are a judgement, not a measurement: a re-audit of the same commit can land a few
points either side of this figure. The evidence underneath it is deterministic — the same
commit always yields the same committed-secret and vulnerable-dependency findings.Scores are a judgment call, not an exact measurement: checking the same saved snapshot of
your code twice can land a few points either side of this number. The evidence underneath
it is not — the same snapshot always turns up the same passwords-in-code and known-security-bug
findings.Scores are a judgment, not a measurement — a re-audit can land a few points either side. The evidence underneath is deterministic: the same commit always yields the same secret and vulnerable-dependency findings.
Each score is the model's overall assessment of the dimensions it covers, across everything it reviewed — not a tally of the findings in this report. Findings are the subset worth acting on, so a score can sit above or below what the listed findings alone would suggest.Each score is the AI's overall judgment of everything it reviewed in that category — not a
count of the problems listed in this report. The listed problems are the ones worth acting
on, so a score can sit above or below what they alone would suggest.Each score is the model's overall assessment across everything it reviewed — not a tally of this report's findings. A score can sit above or below what the findings alone suggest.
nittim guardrail — nittim's safety check — nittim guardrail — The model proposed “ready_with_conditions”; nittim's deterministic layer set the final verdict to “high_risk” because of the executive score falling in the high-risk band. The written rationale below reflects the model's proposal — the verdict above is the one that governs.
Dependency manifests: 1 Maven/Gradle manifest read (declared versions, advisory).
Verdict rationale — Why this verdict — Verdict rationale — Judged against its actual purpose — a public, OWASP-maintained, deliberately exploitable benchmark for scoring vulnerability-detection tools — this repository is mature and fit for purpose: no hardcoded secrets were found, CI runs CodeQL/Spotless/Maven, and the thousands of 'vulnerabilities' are the intended ground-truth payload, not defects, so they must NOT be graded as production security failures. The only genuine conditions are operational and hygiene-level: (1) the app is intentionally and fully exploitable and must never be exposed to an untrusted/production network — treat it strictly as a local/CI/air-gapped harness; (2) refresh the outdated declared dependencies (commons-lang 2.6, bouncycastle 1.70); and (3) tidy the disposable container/deploy config (pin ubuntu:latest, drop the bench:bench and 'changeit' defaults). It is emphatically not a template to copy into a production web app, but as the benchmarking tool it is meant to be, it is ready subject to those conditions. Privacy risk is minimal (synthetic data), and there is no novel IP to protect (public by design), so the ip_protection score is high and independent of the verdict. AI-authorship likelihood is low: the uniformity comes from a deterministic code generator, not an LLM, and does not affect the readiness judgment.