Frozen, scan-ready bundle of the 66 commit-pinned RealVuln Python targets. It contains 2,182 adjudicated cases (1,902 vulnerable and 280 safe controls), including PyGoat.
- Source code is vendored byte-for-byte below
targets/<repoId>/from the exact commits recorded inbundle-manifest.json. - Normalized ground truth is below
oracle/; every finding records its bundle-relative file path. - Each vendored project retains its upstream copyright and license. This aggregation does not relicense upstream code.
- The repository is intentionally frozen: changing any source or label creates a new corpus version and commit.
This layout lets repository scanners evaluate the full RealVuln corpus in one scan while keeping per-project provenance and metrics.