Security Analysis of LLM-Generated Web API Backends

This repository contains the complete experimental framework, dataset, and results for the investigation conducted on the security of Large Language Model (LLM) generated code.

Features

• Benchmark tasks were derived from a triangulation of Stack Overflow trends, GitHub repositories, and OWASP security risks. The complete weighted scoring matrix is available in task-derivation\merged_DRS_scores.xlsx.
• Gemini 2.5 Pro, GPT-5.2, DeepSeek V3.2 are tasked with generating Python FastAPI backends for 5 distinct functional domains (Authentication, RBAC Authorization, File Uploads, Payments, and Webhooks). The script for orchestrating the models uses the Template Method pattern to allow other (possibly newer) models to be easily integrated.
• The security performance of the LLMs is measured using a combination of Static Analysis (SAST), Dynamic Analysis (DAST), and Manual Penetration Testing. The SAST and DAST pipelines use a Decorator pattern to allow additional 3rd-party security tools to be utilized for scanning the backends.

Directory	Description
task-derivation/	Scripts used to mine Stack Overflow and GitHub to define the benchmark tasks.
benchmarks/	Definitions and prompt templates for the 5 core tasks (Auth, RBAC, File Upload, etc.).
data/extracted/	The actual source code generated by the LLMs (GPT-5.2, DeepSeek V3.2, Gemini 2.5 Pro).
data/raw/	Raw JSON responses from the model APIs.
results/	Output from SAST (Bandit & Semgrep), DAST (Schemathesis), and Manual Security Testing.
schemathesis-report/	Interactive HTML reports from the DAST phase.

Setup

This project uses uv for dependency management.

1. Install dependencies:

   uv sync

2. Configure Environment: Copy .env.example to .env and add your API keys:

   OPENAI_API_KEY=sk-...
   DEEPSEEK_API_KEY=sk-...
   GOOGLE_API_KEY=AI...

Reproducing the experiment

1. Benchmark task derivation

To see how the benchmark tasks were selected based on real-world developer data, refer to the Task Derivation README.

2. Generating web APIs

Use the main.py orchestrator to generate implementations for specific tasks and models.

# List all available benchmark tasks
uv run main.py --list-tasks

# Run a specific experiment (e.g., GPT-5.2 on the Authentication task)
uv run main.py --model gpt-5.2 --task task1-auth --iterations 5

The generated code will be extracted to data/extracted/{model}/{task_id}/.

3. Running automated security scans

Automated security scans can be run on the APIs using the validation scripts provided in the validation/ folder.

Dynamic Analysis (DAST):

# Run Schemathesis scans against the APIs generated by a specific model
uv run validation/dast/09_run_dast_scans.py --model gpt-5.2 --limit 5

Static Analysis (SAST):

# First run Bandit and Semgrep
bandit -r data/extracted -f json -o results/sast/bandit_results.json
semgrep --config=auto data/extracted --json > results/sast/semgrep_results.json

# Then aggregate findings from the SAST tools
uv run validation/sast/06_aggregate_sast_findings.py

4. Evaluation results

The security evaluation results from my experiment have been pre-computed and stored in the results/ directory.

• SAST Metrics: see results/sast/sast_findings.xlsx for static analysis vulnerabilities (Bandit/Semgrep).
• DAST Metrics: see results/dast/aggregated/aggregated_results.xlsx for dynamic analysis findings (Schemathesis).
• Manual Audits: See results/manual/manual_pentest_execution.ipynb for the reproduction of the manual penetration tests.