Three real outputs
aiohttp directory traversal
GHSA-5h86-8mv2-jq9fFinds the web-server use and the follow_symlinks setting, and does not
turn "even when symlinks are not present" into a prerequisite. It also repeats
overlapping spans, keeps a bare "set to True" fragment, and does not group the conditions.
Flask session cookie disclosure
GHSA-m2qf-hxjv-5gpqThe advisory lists five conditions that must all hold. The model finds two of them. It misses
both required absences ("does not access or modify the session", "does not set a
Cache-Control header") and the default-on SESSION_REFRESH_EACH_REQUEST, and it
wrongly marks a background phrase as a requirement.
Django MultiPartParser traversal
GHSA-xgxc-v2qg-chmhThe model finds no conditions, and the page says so plainly, without claiming the
conditions do not apply. Both model drafts of this advisory mark the
MultiPartParser requirement and the carve-out "built-in upload handlers were
not affected"; the model finds neither.
- Model: the CRF
crf-batches-01-02from release v0.1.0, with review policyreview-policy-0. The policy is not calibrated, so every item is marked review required. All three advisories are dev documents; none was used for training. - Extraction supports a review. It is not a judgement of whether a deployment is vulnerable, and "no explicit conditions found" is not "not affected".
- Measured quality is low and is reported with intervals in the repository's README. On the 10 hand-labelled dev documents, typed-condition F1 is 0.370 [0.000, 0.640]. Larger dev sets exist only as model drafts, which measure agreement, not accuracy.
- The pages are static. Answers you click stay in your browser until you export them, and nothing is sent anywhere.