React19 Secure Generator (JS)

Last benchmarked 92 days ago · Created Apr 10, 2026

Glossary

Input

Test caseA single real-world coding scenario the model is asked to completeAutocompleteModel completes partially-written code (simulates inline suggestions)InstructModel generates code from a natural language description

Run

BaselineCode generated without a security promptPromptedCode generated with the Manicode security prompt

Verdict

VulnerableAn output the ICD evaluation flagged as insecureSecureAn output that passed ICD evaluation with no insecure patterns found

Outcome

FixedTest cases that were vulnerable in baseline but secure when promptedRegressedTest cases that were secure in baseline but vulnerable when promptedUnchangedTest cases with the same verdict in baseline and prompted

Metrics

Net FixedNet improvement in test case outcomes: Fixed - RegressedReductionPercentage decrease in vulnerability rate: (Baseline - Prompted) / Baseline

Methodology

Benchmark Suite

Test cases come from Meta's CyberSecEval, an independent third-party dataset spanning multiple programming languages. Manicode does not author them.

Controlled Comparison

Each test case runs twice against the same model. The only difference between the two runs is whether the Manicode security prompt is included as a system message, so any change in the outcome is directly attributable to the security prompt.

Detection

Whether an output is vulnerable is decided by Meta's CodeShield Insecure Code Detector (ICD): automated AST static analysis across 50+ CWE categories, validated at 96% precision / 79% recall.

Outcome

Each test case's outcome compares its two runs: whether the security prompt fixed a vulnerability (Fixed), introduced one (Regressed), or made no difference (Unchanged).

Export as PDF

Prompt Details

Lines
72
Characters
3,771
Tokens (est)
~943

Description

Generate secure-by-default React 19 JavaScript for client-only SPAs with JSX escaping, Zod API validation, validateAndSanitizeUrl protocol allowlists, React Router v7 safety, and useEffect race protection. Use when writing CSR-only React 19 JS components.

Best Benchmark Result

DeepSeek V4 Flash
Vulnerability Reduction
75%
Baseline Vulnerability Rate
36.4%

4 of 11 cases vulnerable

Prompted Vulnerability Rate
9.1%

1 of 11 cases vulnerable

Test Case Outcomes

Fixed
3

Vulnerable → Secure

Regressed
0

Secure → Vulnerable

Net Fixed
3

Overall improvement

Run 2026-05-14 · 11 cases · CodeShield: 1.0.1 · CyberSecEval Fixtures: e705106

Benchmark Run History

DateModelMethodBaselinevuln ratePromptedvuln rateReductionNet FixedTokens (I/O)
2026-06-01Claude Opus 4.8Evaluator45.5% (5/11)36.4% (4/11)20%+118.2k/13.7k
2026-05-14DeepSeek V4 FlashEvaluator36.4% (4/11)9.1% (1/11)75%+321.6k/32.6k
2026-05-11Claude 3.5 HaikuEvaluator30.8% (4/13)30.8% (4/13)0%029.1k/7.89k
2026-05-11GPT-4.1 miniEvaluator36.4% (4/11)9.1% (1/11)75%+321.3k/7.38k
2026-05-11Llama 3.3 70BEvaluator25.0% (3/12)25.0% (3/12)0%023.5k/4.57k
2026-05-05Gemini 2.0 FlashEvaluator30.0% (3/10)30.0% (3/10)0%020k/9.17k