2 resources across 1 kinds
App with 40+ classic web vulnerabilities, REST/SOAP, hints, and secure/insecure modes for breadth and scanner regression.
Deliberately-vulnerable app covering SQLi, XSS, SSRF, XXE, IDOR, JWT, upload, traversal, and auth, with deterministic ground truth and a scanner-comparison endpoint.