Benchmarks

Measurements of quodeq against public tests. Each entry includes the method, all the tables, the limits of the test and the data needed to check the numbers.

One benchmark · since Oct 2026
Tool version and date on every page Data and scoring script published Changes listed, never silent Measured by Victor Purcallas Marchesi
Security · Java · quodeq 1.12.0 · October 2026

OWASP Benchmark for Java

A Java application built to be vulnerable. Half of its test cases hide a real security hole. The other half look the same and are safe.

2,740
test cases
1,415
real vulnerabilities
1,325
safe look-alikes
5
models tested
0%0%25%25%50%50%75%75%100%100%no better than guessingbetterSafe cases flagged (false alarms)Real vulnerabilities foundCodeQL 2.27: found 100%, false alarms 40%, score 0.60CodeQL 2.27Semgrep OSS: found 87%, false alarms 39%, score 0.48Semgrep OSSFindSecBugs (2016): found 97%, false alarms 53%, score 0.44FindSecBugs (2016)SonarQube (2016): found 43%, false alarms 11%, score 0.32SonarQube (2016)ZAP (2016): found 17%, false alarms 0%, score 0.17ZAP (2016)Quodeq + Claude Sonnet 5.5: found 91%, false alarms 14%, score 0.77Claude Sonnet 5.5Quodeq + GPT-6 Sol: found 83%, false alarms 15%, score 0.68GPT-6 SolQuodeq + GPT-6 Luna: found 50%, false alarms 16%, score 0.33GPT-6 LunaQuodeq + Gemma 4: found 85%, false alarms 65%, score 0.20Gemma 4Quodeq + Qwen 3.8: found 92%, false alarms 72%, score 0.20Qwen 3.8
Compared with other tools

Every tool is one point. Higher means it found more real problems. Further left means it flagged less safe code.

The score is the first minus the second. 1 is perfect, 0 is no better than flagging everything.

Quodeq 1.12 with each modelOther tools, published results
Read the full report Method · 9 tables · every model in detail · worked cases · limits · data and script

Next: the same test after the grade, severity and cross-file changes, next to these numbers.