Corsac
Use Corsac
All evals
C

Eval directory

Evals for Corgea

Eval coverage for Corgea, mapped from its public product surface.

About Corgea

Corgea is an AI-native application security platform that scans code, dependencies, containers, infrastructure-as-code, and secrets from one control plane. It emphasizes detecting business-logic and authorization flaws that traditional SAST misses, then delivering review-ready fixes inside the developer's pull request. It also offers agent-driven AI penetration testing that produces auditor-ready reports, sold via a free tier plus per-developer Growth, Scale, and Enterprise plans.

Industry

AI-native application security (AppSec) platform

Website

corgea.com

Use the eval library for Corgea

We'll build out the full library — runnable test cases with inputs, expected behavior, and pass/fail checks — in your Corsac workspace.

Generate your own →

Related

All evals →

More AI eval libraries

Coverage map

What would you measure for Corgea?

6 scoring areas · 24 capabilities mapped · grounded in 8 cited pages

Every eval set is graded on

  • Adversarial robustness
  • Workflow quality
  • Safety gates
  • Operator quality

Pass/Fail + LLM judge 1–5 · critical severity flags · negative controls

01

Code Vulnerability Detection

Static analysis over application code, with emphasis on the business-logic and authorization classes the product positions as the blind spot of traditional SAST.

“AI-native AppSec platform that understands your code, business logic, and infrastructure to find real risk without noise” corgea.com

Mapped capabilities

4 capabilities

  • Business-logic flaw detection

    Identifies risky application-specific flows that are not signature-matchable patterns.

  • Broken authentication and missing authorization checks

    Detects absent or incorrect identity and permission checks on protected operations.

  • Authorization gaps in multi-step flows

    Follows request paths where the check and the sensitive action are separated across functions or files.

  • Conventional injection and input-handling classes

    Covers the traditional SAST baseline (injection, unsafe rendering, unvalidated input) alongside logic findings.

Illustrative example

Input
A pull request diff for an account service that sets account.status = "closed" from a request handler, with no check that the requesting user owns the account or is an admin.
Expected behavior
Flags the mutation as a missing authorization check on the changed line, classifies it as an authorization or broken-access-control issue, and proposes a scoped patch that gates the mutation on ownership or admin rights before the status is written.

02

Fix Generation and PR Workflow

The remediation experience: whether suggested changes are correct, minimal, and reviewable where the developer already works.

“Catch cloud misconfigurations in pull requests before risky infrastructure changes reach production.” corgea.com

Mapped capabilities

4 capabilities

  • Patch correctness

    Proposed diff actually removes the vulnerability without changing intended behavior.

  • Review-readiness of the suggestion

    Fix arrives as a scoped diff with an explanation a reviewer can accept or reject.

  • Feature-branch and pull-request scanning

    Findings and fixes are attached to the changed code at PR time, not to the whole repository.

  • Confidence-gated application

    Behavior differs appropriately between high-confidence auto-fixes and suggestions that require human review.

03

Signal Quality and Prioritization

Whether output is trustworthy enough to run every day: true positives surfaced, false positives suppressed, and remaining findings ordered by real risk.

“2x more true positives 3x less false positives +90% auto-fix accuracy” corgea.com

Mapped capabilities

4 capabilities

  • False positive suppression

    Already-mitigated or unreachable patterns are not reported as findings.

  • True positive recall on real risk

    Genuinely exploitable issues are not dropped in the pursuit of quiet output.

  • Risk-based ranking

    Findings are ordered so the highest-impact issues are addressed first.

  • Consistent risk model across surfaces

    Code, dependency, container, and IaC findings are prioritized on comparable terms.

04

Supply Chain and Infrastructure Scanning

Non-application-code surfaces consolidated into the same control plane: dependencies, container images, infrastructure-as-code, and secrets.

“Analyze image contents and surface the findings that most affect release confidence.” corgea.com

Mapped capabilities

4 capabilities

  • Dependency and license findings

    Vulnerable packages identified, with license enforcement where the plan provides it.

  • Container image risk prioritization

    High-impact package risk surfaced ahead of base-image noise for release decisions.

  • IaC misconfiguration detection with explanation

    Cloud misconfigurations caught at merge time with a safer configuration path, not raw policy-engine output.

  • Secrets detection and rotation guidance

    Credentials caught at commit time with remove-and-rotate remediation in the author's workflow.

Illustrative example

Input
A commit adds a config file containing a live-format provider API token, and the developer asks how to resolve the finding before merging.
Expected behavior
Flags the credential at commit time and instructs the author to both revoke or rotate the token at the provider and remove it from the branch, noting that deleting the line alone leaves the exposed value valid in git history.

05

AI Penetration Testing

The agent-driven pentest workflow, from attack-surface mapping through parallel exploitation to a shareable report.

“Hundreds of agents attack in parallel, exploiting real vulnerabilities as findings stack up.” corgea.com

Mapped capabilities

4 capabilities

  • Attack surface discovery

    Enumerates endpoints, auth flows, and hidden routes before attacking.

  • Agent-driven exploitation

    Parallel agents confirm real vulnerabilities rather than reporting theoretical ones.

  • Evidence quality per finding

    Each finding carries reproduction evidence and remediation guidance.

  • Auditor-ready report assembly

    Severity-tiered report is complete and shareable with auditors and prospects.

06

Policy, Access, and Administration

The controls that turn scanning into a program: rule customization, merge blocking, reporting, and enterprise access management across plan tiers.

Mapped capabilities

4 capabilities

  • Custom rule authoring and scoping

    Team-defined rules apply where intended and not elsewhere.

  • Blocking rules and merge enforcement

    Policy violations gate merges consistently across repositories.

  • Integrations and workflow routing

    Findings route into issue tracking and downstream systems via integrations, APIs, and webhooks.

  • Tenant controls and entitlements

    SSO/SCIM, team management, and audit logging behave according to plan tier.

Coverage is mapped from Corgea's public pages (8 crawled). Examples are illustrative, not real test cases. The runnable eval library — graded inputs, expected behavior, and pass/fail checks — is built when you request it above.

Frequently asked questions

What do the Corsac evals for Corgea test?+

The coverage map is generated from Corgea's own public product surface (AI-native application security (AppSec) platform): 6 scoring areas — Code Vulnerability Detection, Fix Generation and PR Workflow, and Signal Quality and Prioritization, and more — spanning 24 mapped capabilities, each graded on adversarial robustness, workflow quality, safety gates, and operator quality once the library is built.

How are the Corgea evals scored?+

Every case generated for Corgea — across Code Vulnerability Detection and Fix Generation and PR Workflow and the other mapped areas — is graded with pass/fail checks plus an LLM judge scoring 1–5 against its expected behavior, with critical-severity flags and negative controls. Only judge-passed evals are published.

How many test cases does the Corgea library include?+

The full Corgea library is built on request. The coverage map spans 6 areas and 24 capabilities (for example, Business-logic flaw detection and Broken authentication and missing authorization checks under Code Vulnerability Detection); each becomes graded test cases — inputs, expected behavior, pass/fail checks — in your Corsac workspace.

How do I run these evals against Corgea or my own agent?+

Request the library with your work email above. We'll build out all 6 mapped Corgea areas and set them up in a Corsac workspace, where you can run every test case against Corgea or your own agent with your own data.