GPT-5.4 Nano

Performance is excellent overall at 95.2, with correct handling of file uploads, HTML encoding, redirects, and URL sanitization. The main miss is hostname allowlisting, where it rejected wildcard subdomains and punycode cases that should have matched, indicating incomplete wildcard/IDN normalization logic.

This domain is mixed at 78.3: cookie policy, CSRF, JWT, refresh rotation, and fixation detection were solid, but OAuth state validation failed catastrophically with null returns and a TypeError, suggesting an unhandled undefined input path. Password strength scoring was also inconsistent, over-penalizing some weak passwords and misclassifying others, which points to unstable heuristic weighting.

Access control is a clear strength at 94.8, with the engine and permission checker performing reliably. There are no notable weaknesses, so the model appears dependable for rule-based authorization logic.

At 72.5, this is the most uneven non-crypto area. It over-reported anomalies in auth logs, underperformed badly on SSRF detection by labeling valid URLs as invalid, and the insecure config scanner used different issue labels than expected, suggesting both semantic drift and brittle output formatting.

Traffic protection is effectively solved here at 99.5, with rate limiting handled correctly. This is the most stable domain in the benchmark.

Crypto utilities are the weakest area at 56.0, driven by a hard failure in sec-crypto-utils where charCodeAt was called on a non-string input. That kind of runtime exception, plus missed outputs in the same task family, indicates poor input type handling and insufficient defensive coding.