# GapBench recall anchors — vibe-eval public benchmark (SlopEmu v0.2.0), 104 CWE-tagged scenarios.
# REMOTE + hosted-only (no self-host); explicitly built for scanners to point at (path /site/{scenario}/).
# Ground truth (each scenario id -> vuln class + intended CWEs): ./gapbench-manifest.json (live: /__manifest).
# URLs are https:// (the manifest lists http:// but the site 308-redirects http->https; wire the final form).
# Grade:  run_batch --urls validation/vuln-corpus/gapbench.txt --url-only --concurrency 3   (be polite — it is
#         their infra; keep concurrency low). Anchor-tagged (project=anchor-gapbench-*) so the single shared
#         host (gapbench.vibe-eval.com) is EXEMPT from the platform-inference DNF that would otherwise nuke all 104.
# format: URL,project-tag
https://gapbench.vibe-eval.com/site/ai-startup/,anchor-gapbench-ai-startup
https://gapbench.vibe-eval.com/site/indie-saas/,anchor-gapbench-indie-saas
https://gapbench.vibe-eval.com/site/hosting-panel-bypass/,anchor-gapbench-hosting-panel-bypass
https://gapbench.vibe-eval.com/site/enterprise-legacy/,anchor-gapbench-enterprise-legacy
https://gapbench.vibe-eval.com/site/supabase-clone/,anchor-gapbench-supabase-clone
https://gapbench.vibe-eval.com/site/naked-postgres/,anchor-gapbench-naked-postgres
https://gapbench.vibe-eval.com/site/nextjs-app/,anchor-gapbench-nextjs-app
https://gapbench.vibe-eval.com/site/graphql-api/,anchor-gapbench-graphql-api
https://gapbench.vibe-eval.com/site/fintech-app/,anchor-gapbench-fintech-app
https://gapbench.vibe-eval.com/site/ecommerce-advanced/,anchor-gapbench-ecommerce-advanced
https://gapbench.vibe-eval.com/site/devops-leak/,anchor-gapbench-devops-leak
https://gapbench.vibe-eval.com/site/poisoned-ci-action/,anchor-gapbench-poisoned-ci-action
https://gapbench.vibe-eval.com/site/staging-env/,anchor-gapbench-staging-env
https://gapbench.vibe-eval.com/site/cors-misconfig/,anchor-gapbench-cors-misconfig
https://gapbench.vibe-eval.com/site/mobile-backend/,anchor-gapbench-mobile-backend
https://gapbench.vibe-eval.com/site/multi-tenant-saas/,anchor-gapbench-multi-tenant-saas
https://gapbench.vibe-eval.com/site/cms-platform/,anchor-gapbench-cms-platform
https://gapbench.vibe-eval.com/site/auth-system/,anchor-gapbench-auth-system
https://gapbench.vibe-eval.com/site/internal-tools/,anchor-gapbench-internal-tools
https://gapbench.vibe-eval.com/site/analytics-dashboard/,anchor-gapbench-analytics-dashboard
https://gapbench.vibe-eval.com/site/file-upload/,anchor-gapbench-file-upload
https://gapbench.vibe-eval.com/site/chat-app/,anchor-gapbench-chat-app
https://gapbench.vibe-eval.com/site/config-leak/,anchor-gapbench-config-leak
https://gapbench.vibe-eval.com/site/git-exposed/,anchor-gapbench-git-exposed
https://gapbench.vibe-eval.com/site/feature-flags/,anchor-gapbench-feature-flags
https://gapbench.vibe-eval.com/site/hybrid-modern/,anchor-gapbench-hybrid-modern
https://gapbench.vibe-eval.com/site/agent-tool-abuse/,anchor-gapbench-agent-tool-abuse
https://gapbench.vibe-eval.com/site/rag-poisoning/,anchor-gapbench-rag-poisoning
https://gapbench.vibe-eval.com/site/mcp-open/,anchor-gapbench-mcp-open
https://gapbench.vibe-eval.com/site/vector-db-leak/,anchor-gapbench-vector-db-leak
https://gapbench.vibe-eval.com/site/oauth-redirect/,anchor-gapbench-oauth-redirect
https://gapbench.vibe-eval.com/site/password-reset-flaws/,anchor-gapbench-password-reset-flaws
https://gapbench.vibe-eval.com/site/jwt-alg-confusion/,anchor-gapbench-jwt-alg-confusion
https://gapbench.vibe-eval.com/site/magic-link-otp/,anchor-gapbench-magic-link-otp
https://gapbench.vibe-eval.com/site/ssrf-image-proxy/,anchor-gapbench-ssrf-image-proxy
https://gapbench.vibe-eval.com/site/sqli-raw/,anchor-gapbench-sqli-raw
https://gapbench.vibe-eval.com/site/nosql-injection/,anchor-gapbench-nosql-injection
https://gapbench.vibe-eval.com/site/ssti/,anchor-gapbench-ssti
https://gapbench.vibe-eval.com/site/mass-assignment/,anchor-gapbench-mass-assignment
https://gapbench.vibe-eval.com/site/open-redirect/,anchor-gapbench-open-redirect
https://gapbench.vibe-eval.com/site/xxe-svg/,anchor-gapbench-xxe-svg
https://gapbench.vibe-eval.com/site/zip-slip/,anchor-gapbench-zip-slip
https://gapbench.vibe-eval.com/site/webhook-unverified/,anchor-gapbench-webhook-unverified
https://gapbench.vibe-eval.com/site/stripe-paid-trust/,anchor-gapbench-stripe-paid-trust
https://gapbench.vibe-eval.com/site/swagger-exposed/,anchor-gapbench-swagger-exposed
https://gapbench.vibe-eval.com/site/sentry-dsn-leak/,anchor-gapbench-sentry-dsn-leak
https://gapbench.vibe-eval.com/site/prototype-pollution/,anchor-gapbench-prototype-pollution
https://gapbench.vibe-eval.com/site/postmessage-no-origin/,anchor-gapbench-postmessage-no-origin
https://gapbench.vibe-eval.com/site/csp-missing/,anchor-gapbench-csp-missing
https://gapbench.vibe-eval.com/site/csrf-missing/,anchor-gapbench-csrf-missing
https://gapbench.vibe-eval.com/site/s3-public-bucket/,anchor-gapbench-s3-public-bucket
https://gapbench.vibe-eval.com/site/subdomain-takeover/,anchor-gapbench-subdomain-takeover
https://gapbench.vibe-eval.com/site/redis-open/,anchor-gapbench-redis-open
https://gapbench.vibe-eval.com/site/mongo-open/,anchor-gapbench-mongo-open
https://gapbench.vibe-eval.com/site/ref0/,anchor-gapbench-ref0
https://gapbench.vibe-eval.com/site/agent-confused-deputy/,anchor-gapbench-agent-confused-deputy
https://gapbench.vibe-eval.com/site/indirect-prompt-injection/,anchor-gapbench-indirect-prompt-injection
https://gapbench.vibe-eval.com/site/llm-html-rendering/,anchor-gapbench-llm-html-rendering
https://gapbench.vibe-eval.com/site/request-smuggling/,anchor-gapbench-request-smuggling
https://gapbench.vibe-eval.com/site/crlf-response-splitting/,anchor-gapbench-crlf-response-splitting
https://gapbench.vibe-eval.com/site/cache-poisoning/,anchor-gapbench-cache-poisoning
https://gapbench.vibe-eval.com/site/redos/,anchor-gapbench-redos
https://gapbench.vibe-eval.com/site/insecure-deser/,anchor-gapbench-insecure-deser
https://gapbench.vibe-eval.com/site/tls-downgrade/,anchor-gapbench-tls-downgrade
https://gapbench.vibe-eval.com/site/weak-randomness/,anchor-gapbench-weak-randomness
https://gapbench.vibe-eval.com/site/cookie-scope-leak/,anchor-gapbench-cookie-scope-leak
https://gapbench.vibe-eval.com/site/download-traversal/,anchor-gapbench-download-traversal
https://gapbench.vibe-eval.com/site/ldap-injection/,anchor-gapbench-ldap-injection
https://gapbench.vibe-eval.com/site/xpath-injection/,anchor-gapbench-xpath-injection
https://gapbench.vibe-eval.com/site/email-mime-injection/,anchor-gapbench-email-mime-injection
https://gapbench.vibe-eval.com/site/dom-clobbering/,anchor-gapbench-dom-clobbering
https://gapbench.vibe-eval.com/site/dom-fragment-xss/,anchor-gapbench-dom-fragment-xss
https://gapbench.vibe-eval.com/site/pdf-html-injection/,anchor-gapbench-pdf-html-injection
https://gapbench.vibe-eval.com/site/markdown-html-injection/,anchor-gapbench-markdown-html-injection
https://gapbench.vibe-eval.com/site/oauth-token-leak-referer/,anchor-gapbench-oauth-token-leak-referer
https://gapbench.vibe-eval.com/site/pkce-downgrade/,anchor-gapbench-pkce-downgrade
https://gapbench.vibe-eval.com/site/weak-password-policy/,anchor-gapbench-weak-password-policy
https://gapbench.vibe-eval.com/site/audit-log-tamper/,anchor-gapbench-audit-log-tamper
https://gapbench.vibe-eval.com/site/gcp-metadata-ssrf/,anchor-gapbench-gcp-metadata-ssrf
https://gapbench.vibe-eval.com/site/kube-dashboard-open/,anchor-gapbench-kube-dashboard-open
https://gapbench.vibe-eval.com/site/grpc-reflection/,anchor-gapbench-grpc-reflection
https://gapbench.vibe-eval.com/site/websocket-no-origin/,anchor-gapbench-websocket-no-origin
https://gapbench.vibe-eval.com/site/dns-rebinding/,anchor-gapbench-dns-rebinding
https://gapbench.vibe-eval.com/site/clipboard-paste-xss/,anchor-gapbench-clipboard-paste-xss
https://gapbench.vibe-eval.com/site/prompt-leak-via-error/,anchor-gapbench-prompt-leak-via-error
https://gapbench.vibe-eval.com/site/tool-output-injection/,anchor-gapbench-tool-output-injection
https://gapbench.vibe-eval.com/site/function-calling-arg-poison/,anchor-gapbench-function-calling-arg-poison
https://gapbench.vibe-eval.com/site/session-fixation/,anchor-gapbench-session-fixation
https://gapbench.vibe-eval.com/site/email-change-no-reauth/,anchor-gapbench-email-change-no-reauth
https://gapbench.vibe-eval.com/site/host-header-injection/,anchor-gapbench-host-header-injection
https://gapbench.vibe-eval.com/site/elasticsearch-open/,anchor-gapbench-elasticsearch-open
https://gapbench.vibe-eval.com/site/firebase-rules-open/,anchor-gapbench-firebase-rules-open
https://gapbench.vibe-eval.com/site/weak-jwt-secret/,anchor-gapbench-weak-jwt-secret
https://gapbench.vibe-eval.com/site/race-condition-balance/,anchor-gapbench-race-condition-balance
https://gapbench.vibe-eval.com/site/ref-oauth/,anchor-gapbench-ref-oauth
https://gapbench.vibe-eval.com/site/ref-jwt/,anchor-gapbench-ref-jwt
https://gapbench.vibe-eval.com/site/ref-webhook/,anchor-gapbench-ref-webhook
https://gapbench.vibe-eval.com/site/ref-rls/,anchor-gapbench-ref-rls
https://gapbench.vibe-eval.com/site/npm-typosquat/,anchor-gapbench-npm-typosquat
https://gapbench.vibe-eval.com/site/docker-config-leak/,anchor-gapbench-docker-config-leak
https://gapbench.vibe-eval.com/site/terraform-state-leak/,anchor-gapbench-terraform-state-leak
https://gapbench.vibe-eval.com/site/mcp-tool-spec-injection/,anchor-gapbench-mcp-tool-spec-injection
https://gapbench.vibe-eval.com/site/noisy-errors/,anchor-gapbench-noisy-errors
https://gapbench.vibe-eval.com/site/captcha-challenge/,anchor-gapbench-captcha-challenge
