[SizzleUnrlsd]

Summary

Corpus item of #71: five public repositories of other kinds join the regression suite.

Repository	Kind	Lines	Findings
dvpwa	intentionally vulnerable aiohttp application	700	4
pygoat	intentionally vulnerable Django application	4 000	53
full-stack-fastapi-template	FastAPI backend template	2 900	12
httpie	HTTP client command-line tool	19 000	11
luigi	data-pipeline framework and workers	63 000	70

• Every finding was read against the code. pygoat's labs are all found: command injection through subprocess.Popen, SQL injection through objects.raw, SSRF, pickle and yaml.load deserialization (the latter correlated with the required vulnerable PyYAML), path traversal, reflected XSS through HttpResponse, eval, debug=True.
• The corpus also exposes gaps, recorded as tasks on Precision: nonlocal write-back and a broader regression corpus #71 and Detection coverage: syntactic rules and models for aiohttp, Tornado, Bottle and database drivers #70 and left as they are in the snapshots so the fixes show their effect: class keyword arguments and with targets other than a name reject whole files (15 files); environment and process-output sources are operator-controlled and should not carry COMMAND and PATH (httpie's daemon, luigi's contrib modules); dvpwa's SQL injections and XSS are silent because aiohttp has no models yet.
• The whole regression suite now covers 19 repositories, 280 findings, and runs in about a minute.

Part of #71.