Illustrative · founding partner slot open

Anonymous API scanner benchmark

Example of how teams use VulnGym in CI — numbers match our public sample report until a founding partner opts in with real branding.

17 / 23Verified on ProofRange
0 / 6Decoy false positives

Challenge

Engineering needed a neutral target to regression-test authenticated API chains and measure precision, not alert volume, before a enterprise RFI.

Approach

  1. Blind run Reseed ProofRange with a Pro operator key; scan with attacker credentials only.
  2. Score offline Map findings to truth v1.5.0; generate Vendor Score Report v1.
  3. Gate release Fail CI if verified count drops or any decoy trips.

Outcome

Team prioritized SSTI, deserialization, and cache-poisoning detectors after gap analysis on IDs 6, 12, 13, and 21 — classes that rarely appear in unauthenticated crawl benchmarks.

View sample report Become a named case study