Reproducible accuracy
OWASP Benchmark results
We run the industry-standard OWASP Benchmark and publish every number — including the categories where we still have work to do. Re-run it yourself with one command.
0.582
Benchmark score
92.5%
Precision
63.7%
Recall
5.5%
False positives
Per-category breakdown
| Category | Score | Recall | Precision | FPR |
|---|---|---|---|---|
| Weak Randomness | 1.000 | 100.0% | 100.0% | 0.0% |
| Insecure Cookie | 1.000 | 100.0% | 100.0% | 0.0% |
| Weak Cryptography | 0.808 | 80.8% | 100.0% | 0.0% |
| Weak Hashing | 0.690 | 69.0% | 100.0% | 0.0% |
| Cross-Site Scripting | 0.516 | 57.3% | 92.2% | 5.7% |
| LDAP Injection | 0.499 | 59.3% | 84.2% | 9.4% |
| XPath Injection | 0.467 | 46.7% | 100.0% | 0.0% |
| Command Injection | 0.451 | 57.9% | 82.0% | 12.8% |
| Path Traversal | 0.445 | 53.4% | 85.5% | 8.9% |
| SQL Injection | 0.303 | 39.0% | 84.1% | 8.6% |
| Trust Boundary | 0.237 | 47.0% | 79.6% | 23.3% |
Score is Youden’s J (recall − false-positive rate), with strict OWASP CWE-per-category matching. Every category now registers detections; the lowest-scoring (trust boundary, SQL injection) are deliberately precision-first partial coverage, honestly reported rather than hidden.
Reproduce it
# clone the benchmark and run Shield against it
git clone --depth 1 https://github.com/OWASP-Benchmark/BenchmarkJava && OWASP_BENCH=$PWD/BenchmarkJava make bench-owasp
Engine: SAST — regex + intra-file taint + dataflow (constant-fold / key-sensitive). Environment: 4 vCPU, go1.25.1, Linux. The archive is versioned and served at /api/benchmark.