Grok 4.20 (Non-Reasoning)

Performance is excellent across file upload, hostname allowlisting, HTML entity encoding, safe redirects, and URL sanitization, with no meaningful weaknesses. This domain looks robust and consistent under both visible and hidden cases.

This domain is uneven: cookie policy, CSRF token handling, refresh-token rotation, and session fixation detection are strong, but JWT validation and OAuth state handling are brittle. The JWT task appears to reject malformed tokens too early instead of parsing headers/payloads, while the OAuth state validator throws a length-related TypeError, indicating a structural bug rather than a logic miss.

Access control is a clear strength, with strong results on API key scope checking and tenant isolation. The model handled authorization boundaries correctly and did not show notable edge-case regressions here.

This is the most inconsistent domain: insecure config scanning is strong, but anomaly detection, dependency risk classification, secret detection, SSRF detection, and vulnerability scanning all show different failure modes. The errors range from under-detection and over-detection to runtime exceptions and overly strict URL parsing, which points to weak normalization and inconsistent rule application.

Rate limiting is effectively perfect, with no significant weaknesses. The model appears reliable for deterministic traffic-control logic.

Cryptographic utility handling is weak overall despite one strong encryption pipeline result. The failing crypto-utils task shows runtime errors from undefined length access and an empty-string output where a formatted value was expected, suggesting poor input handling and broken helper logic.