securecode-v2

SecureCode v2.0: Production-Grade Dataset for Security-Aware Code Generation

<div align="center">

Production-grade security vulnerability dataset with complete incident grounding, 4-turn conversational structure, and comprehensive operational guidance

📄 Paper | 💻 GitHub | 🤗 Dataset

</div>

---

🎯 Overview

SecureCode v2.0 is a rigorously validated dataset of 1,215 security-focused coding examples designed to train security-aware AI code generation models. Every example is grounded in real-world security incidents (CVEs, breach reports), provides both vulnerable and secure implementations, demonstrates concrete attacks, and includes defense-in-depth operational guidance.

Why SecureCode v2.0?

The Problem: AI coding assistants produce vulnerable code in 45% of security-relevant scenarios (Veracode 2025), introducing security flaws at scale.

The Solution: SecureCode v2.0 provides production-grade training data with:

• ✅ 100% Incident Grounding – Every example ties to documented CVEs or security incidents
• ✅ 4-Turn Conversational Structure – Mirrors real developer-AI workflows
• ✅ Complete Operational Guidance – SIEM integration, logging, monitoring, detection
• ✅ Full Language Fidelity – Language-specific syntax, idioms, and frameworks
• ✅ Rigorous Validation – 100% compliance with structural and security standards

---

📊 Dataset Statistics

Vulnerability Coverage (OWASP Top 10:2025)

Programming Language Distribution

Severity Distribution

---

🔍 What Makes This Different?

1. Incident Grounding

Every example references real security incidents:

• Equifax breach (CVE-2017-5638) - $425M cost from Apache Struts RCE
• Capital One SSRF attack (2019) - 100M customer records exposed
• SolarWinds supply chain (CVE-2020-10148) - Documented authentication bypasses

2. 4-Turn Conversational Structure

Unlike code-only datasets, each example follows realistic developer workflows:

Turn 1: Developer requests functionality ("build JWT authentication")
Turn 2: Assistant provides vulnerable + secure implementations with attack demos
Turn 3: Developer asks advanced questions ("how does this scale to 10K users?")
Turn 4: Assistant delivers defense-in-depth operational guidance

3. Comprehensive Operational Guidance

Every example includes:

• SIEM Integration - Splunk/Elasticsearch detection rules
• Logging Strategies - Security event capture patterns
• Monitoring Recommendations - Metrics and alerting
• Infrastructure Hardening - Docker, AppArmor, WAF configs
• Testing Approaches - Language-specific security testing

4. Rigorous Quality Validation

• ✅ 100% CVE Format Compliance - All CVE references validated
• ✅ 100% Language Tag Validity - Proper language assignments
• ✅ 100% Structural Compliance - 4-turn conversation format
• ✅ Expert Security Review - Independent validation by security professionals
• ✅ Zero Content Duplicates - 1,203 duplicates removed

---

📁 Dataset Structure

securecode-v2/
├── consolidated/
│   ├── train.jsonl              # 989 training examples
│   ├── val.jsonl                # 122 validation examples
│   └── test.jsonl               # 104 test examples
├── docs/
│   └── paper/
│       ├── secure-code-v2.md    # Full research paper (markdown)
│       ├── secure-code-v2.tex   # LaTeX version
│       └── *.png                # Paper figures and charts
├── scripts/
│   └── validate_contributing_compliance.py
├── README.md                    # This file
├── CONTRIBUTING.md              # Contribution guidelines
├── LICENSE                      # CC BY-NC-SA 4.0 license
├── CITATION.bib                 # Citation information
├── schema_v2.json               # Dataset schema
└── taxonomy.yaml                # OWASP vulnerability taxonomy

Example Format

Each example is a 4-turn conversation in JSON format:

{
  "messages": [
    {
      "role": "user",
      "content": "How do I implement secure JWT authentication in Express.js?"
    },
    {
      "role": "assistant",
      "content": "# Real-World Incident\nCVE-2022-23529: JWT authentication bypass in production systems...\n\n## Vulnerable Implementation\n[Code showing vulnerability]\n\n## Secure Implementation\n[Code showing fix]\n\n## Attack Demonstration\n[Concrete exploit]"
    },
    {
      "role": "user",
      "content": "How does this scale to 10,000 concurrent users?"
    },
    {
      "role": "assistant",
      "content": "# Production Scaling & Defense-in-Depth\n\n## Performance Considerations\n[Scaling strategies]\n\n## SIEM Integration\n[Detection rules]\n\n## Monitoring & Logging\n[Operational security]"
    }
  ]
}

---

🚀 Usage

Load with Hugging Face Datasets

from datasets import load_dataset

# Load the full dataset
dataset = load_dataset("scthornton/securecode-v2")

# Access splits
train_data = dataset["train"]
val_data = dataset["validation"]
test_data = dataset["test"]

# Inspect an example
print(train_data[0]["messages"])

Fine-Tuning Example

from transformers import AutoModelForCausalLM, AutoTokenizer, Trainer, TrainingArguments

model_name = "meta-llama/Llama-3.2-3B"
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForCausalLM.from_pretrained(model_name)

# Prepare dataset for training
def format_conversation(example):
    formatted = tokenizer.apply_chat_template(
        example["messages"],
        tokenize=False
    )
    return {"text": formatted}

train_dataset = dataset["train"].map(format_conversation)

# Configure training
training_args = TrainingArguments(
    output_dir="./securecode-finetuned",
    num_train_epochs=3,
    per_device_train_batch_size=4,
    learning_rate=2e-5,
    logging_steps=100,
)

trainer = Trainer(
    model=model,
    args=training_args,
    train_dataset=train_dataset,
)

trainer.train()

---

📖 Citation

If you use SecureCode v2.0 in your research, please cite:

@misc{thornton2025securecode,
  title={SecureCode v2.0: A Production-Grade Dataset for Training Security-Aware Code Generation Models},
  author={Thornton, Scott},
  year={2025},
  month={December},
  publisher={perfecXion.ai},
  url={https://perfecxion.ai/articles/securecode-v2-dataset-paper.html},
  note={Dataset: https://huggingface.co/datasets/scthornton/securecode-v2}
}

---

📄 License

This dataset is released under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).

What this means:

• ✅ Free for Research & Education - Use freely in academic research, publications, and teaching
• ✅ Derivative Works Allowed - You can modify, extend, and improve the dataset
• ✅ Share-Alike - Derivatives must use the same CC BY-NC-SA 4.0 license
• ✅ Attribution Required - Credit the original work when used
• ❌ No Commercial Use - Cannot be used in commercial products or services without permission

For commercial licensing inquiries, contact: scott@perfecxion.ai

---

🔗 Links

• 📄 Research Paper: https://perfecxion.ai/articles/securecode-v2-dataset-paper.html
• 💻 GitHub Repository: https://github.com/scthornton/securecode-v2
• 🤗 HuggingFace Dataset: https://huggingface.co/datasets/scthornton/securecode-v2
• 🛠️ Validation Framework: validate_contributing_compliance.py

---

🤝 Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines on:

• Adding new vulnerability examples
• Improving existing content
• Validation and quality assurance
• Documentation improvements

---

🙏 Acknowledgments

• Security research community for responsible disclosure practices
• Three anonymous security experts who provided independent validation
• OWASP Foundation for maintaining the Top 10 taxonomy
• MITRE Corporation for the CVE database

---

📊 Quality Metrics