PySecPatch-72K

PySecPatch-72K is a deterministic, generated Python vulnerability triage and repair corpus. It contains 72,000 records organized as two training stages. The dataset was built for defensive secure-coding research and is released under Apache-2.0.

Creator: Ahmed Bin Khalid, Independent Researcher (ORCID 0000-0002-0616-2604)

Dataset Structure

Only train splits were used for model optimization. Splits were assigned by template family rather than by row to reduce structural memorization across evaluation boundaries.

Stage A covers 35 CWEs and 40 generator profiles. Stage B covers 43 CWEs and 50 profiles across detection, snippet repair, clean negatives, and repository-patch selection. Stage B contains 24,000 detection records, 24,000 repair records, and 12,000 repository-patch records.

Provenance and Licensing

All examples were generated specifically for PySecPatch. No random GitHub repositories or unknown-license datasets were used for training. Records identify the source as generated and the source license as Apache-2.0. Guidance references point to public secure-coding documentation, but the dataset does not reproduce third-party source code.

Decontamination

• Exact duplicate records were removed.
• Normalized vulnerable and fixed code were hashed.
• Template families were isolated across train, test, and holdout.
• The cross-stage audit found zero exact IDs and zero exact normalized code/fix pairs.
• The audit found 702 shared abstract structures across stages; this is disclosed rather than treated as exact contamination.

Detailed statistics and contamination reports are included for both configurations.

Stage A Schema

Stage A records contain:

{
  "id": "...",
  "family": "...",
  "split": "train|val|test|holdout",
  "language": "python",
  "cwe": "CWE-089",
  "vuln_type": "...",
  "is_vulnerable": true,
  "vulnerable_code": "...",
  "fixed_code": "...",
  "vulnerable_lines": [3, 4],
  "explanation": "...",
  "patch_summary": "...",
  "safe_test": "...",
  "source": "generated",
  "source_license": "Apache-2.0"
}

Released under the Apache License 2.0. See LICENSE.

The canonical dataset record is 10.5281/zenodo.21016753. The related software release is 10.5281/zenodo.21015885.

Stage B Tasks

Stage B extends the controlled schema with three task types:

• detect: vulnerability classification, CWE assignment, localization, and clean-negative restraint.
• repair: secure snippet repair and test generation.
• repo_patch: finding-specific patch selection, rejected alternatives, and verifier-aware behavior.

Consumers should treat the two stages as separate configurations because their task schemas differ.

Limitations

• The corpus is generated and does not reproduce the ambiguity of full production repositories.
• Structural diversity does not guarantee real-world distributional coverage.
• Framework behavior is represented by small examples rather than complete deployments.
• High performance on these splits does not establish repository-level repair reliability.

Ethical Use

The dataset is intended for defensive vulnerability detection, secure coding, repair verification, and reproducibility research. It must not be used to automate unauthorized scanning, exploit development, malware, credential theft, persistence, or evasion.

Citation

@dataset{khalid2026pysecpatch72k,
  author = {Bin Khalid, Ahmed},
  title  = {PySecPatch-72K: A Family-Disjoint Python Security Triage and Repair Corpus},
  year   = {2026},
  version = {0.1.1},
  publisher = {Zenodo},
  doi    = {10.5281/zenodo.21016753},
  url    = {https://doi.org/10.5281/zenodo.21016753}
}