Every planted vulnerability has a machine-checkable signal. Decoys measure precision. Official runs use blind evaluation — the scanner never receives the answer key at runtime.
Your finding maps to a planted vuln ID (keyword + endpoint + class heuristics). Weaker signal — useful for coverage tracking.
Evidence matches the oracle’s confirmation chain (e.g. exploitable output, OOB correlation, state change). Primary score for marketing and regression gates.
Six safe endpoints per ring designed to look tempting. Any verified-style hit on a decoy is a ground-truth false positive — precision matters.
TP / (TP + decoy FP)
Reported at vuln-map level, not raw alert count.
| Allowed at scan time | Forbidden at scan time |
|---|---|
| Target URL (e.g. proofrange.vulngym.com) | truth.json inside the scanner |
| Attacker credentials (Alice — fixed) | Operator manifest (rotating victim/admin) |
| Your product’s normal crawl/exploit logic | Hard-coded vuln IDs from a prior run |
After the scan, you may score offline with the oracle. That separation keeps benchmarks honest across vendors.
truth_version (e.g. 1.5.0) for reproducibility.| Ring | Lab | Planted | Focus |
|---|---|---|---|
| 1 | ProofRange | 23 | Auth API, JWT, SSRF/OOB, logic, RCE chains |
| 2 | AgentRange | 10 | GraphQL, MCP tools, agent scope abuse |
| 3 | MeshRange | 10 | gRPC, WebSocket, OAuth replay, mesh trust |
coverage.js proves vulnerabilities are exploitable (operator tool).
Your score measures your product against that ground truth — typically lower than 23/23 until your engine matures. We publish both concepts separately to avoid confusion.