A deliberately vulnerable ASP.NET Core MVC training application that demonstrates 10 common security vulnerabilities through a clean, friendly UI.

It is designed for:

• security awareness demos
• AppSec workshops
• AI-assisted code review comparisons
• scanner benchmarking
• remediation walkthroughs

Most vulnerable demo apps are either too dated, too ugly, or too unrealistic for modern AI-tool evaluations.

Security Vuln Lab aims to be:

• simple enough for demos
• modern enough for real scanner experiments
• structured enough to produce repeatable results
• friendly enough to show live in front of an audience

This repo helps you answer questions like:

• Can an AI security reviewer find all 10 issues?
• Does a scanner correctly classify them?
• Does the tool explain real impact, or just label patterns?
• Does it point to the right files and code locations?
• How useful are the remediation suggestions?

• .NET 8
• ASP.NET Core MVC
• Razor Views
• GitHub Actions for CI build validation

SecurityVulnLab/
├── Controllers/
├── Models/
├── Services/
├── Views/
├── wwwroot/
├── .github/
├── README.md
├── SCANNER-EVAL.md
└── SecurityVulnLab.csproj

Key files:

• Controllers/HomeController.cs → intentionally vulnerable server-side patterns
• Views/Home/*.cshtml → demo UI and client-side rendering patterns
• Services/VulnerabilityCatalog.cs → vulnerability index, metadata, and remediation notes
• SCANNER-EVAL.md → scorecard starter for AI/security tooling comparisons

If dotnet is already installed:

dotnet restore
dotnet run

Or use the helper script included in this repo:

./run-local.sh

Then open:

• http://localhost:5155

The app includes a simple dashboard that:

• lists all 10 vulnerabilities
• shows severity and category
• links to per-vulnerability detail pages
• gives demo-friendly examples and remediation notes

That makes it useful for both:

• live walkthroughs with developers or security teams
• automated reviews by AI or SAST tools

Use multiple tools and compare their output against the known ground truth.

Suggested tool categories:

• SAST scanners
• secret scanners
• LLM code review tools
• AI security agents
• IDE security assistants

Suggested scoring dimensions:

• Coverage — how many of the 10 vulnerabilities were found?
• Precision — how many false positives were reported?
• Code accuracy — did the tool point to the right file/line/location?
• Explanation quality — did it explain real impact clearly?
• Remediation quality — were the fixes practical and correct?

See also:

• SCANNER-EVAL.md

1. Clone the repository
2. Run each security tool against the same commit
3. Record findings in a scorecard
4. Compare coverage vs false positives
5. Review whether remediation advice is actually useful
6. Optionally compare results against a future secure branch

Planned next improvements:

• screenshots/GIFs for the landing page and demo flows
• a secure branch with remediated implementations
• a comparison matrix of popular AI security tools
• more realistic data and auth simulation

A few vulnerabilities here are intentionally obvious. That is by design.

The goal is not to create an ultra-realistic red-team target. The goal is to create a repeatable, inspectable benchmark for humans and tools.

See LICENSE.