Cybersecurity training data

Find vulnerabilities.Build stronger fixes.

Train on real codebases and running servers. Choose defensive tasks, offensive tasks, or your own mix.

Try 5 Samples

4,000tasks available

3,000defensive

1,000offensive

Real repository

src/
tests/
toolchain/

Running target

Runnable environments. Verified rewards.

The Cyber catalog

Choose your security task family.

Defensive

Audit and patch

3,000tasks available

Real repository

Find & fix

Security + regressions

Discover the vulnerability. Patch it without breaking the software.

Offensive

Black-box exploitation

1,000tasks available

Running server

Black-box testing

Proof + flag

Find an exploitable path without source access. Deliver a reproducible proof.

Explore with samples

Buy either family or combine them. Choose the volume you need.

Inside a defensive task: GuardDog, CWE-116

One fixed path isn't a complete fix.

Untrusted text reaches two reports. The patch must protect both.

Untrusted packageTerminal control bytes

Scanner outputTwo reporting paths

Human report✓ Protected

SARIF report× Still exposed

The SARIF path is still exposed.Coverage illustration

Read the task and verification summary

The task asks the agent to audit and patch a real repository where untrusted package text reaches both the human-readable report and the SARIF report. A patch to only one reporting path leaves the other exposed.

The fix must cover both reporting paths and preserve legitimate behavior. Review the task specification, environment, reward verifier, and reference solution in the sample package.

Request the complete sample package ↗

Included with your tasks