> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/tutorials/owasp-benchmark.md).

# OWASP Benchmark

This article will show you how to scan the [OWASP Benchmark](https://owasp.org/www-project-benchmark/) app with Qwiet AI by Harness and score its results.

## Scanning the OWASP Benchmark app with Qwiet AI by Harness and viewing the results <a href="#scanning-the-owasp-benchmark-app-with-qwiet-ai-by-harness-and-viewing-the-results" id="scanning-the-owasp-benchmark-app-with-qwiet-ai-by-harness-and-viewing-the-results"></a>

1. Create a Qwiet account (if necessary) and log in to the [dashboard](https://app.shiftleft.io/dashboard).
2. Near the top left of the **Applications** page, click **+Add** in the **Applications** box.

   ![Add app](/files/yvjRQMmmQkel01ZlWUb6)
3. Under **Automated**, click **Next** to proceed with the **GitHub Repository** option.

   ![Select GitHub repo](/files/8vyKCtg1FePHMlG8Qt6V)
4. On **Workflow Setup**, select **OWASP Benchmark** and click **Next** in the top-right to proceed. Wait for Qwiet to complete the demo workflow setup process.

   ![Choose demo repo](/files/hINrQB5CgqeIijuQbGVk)
5. When your demo is set up, click **See Demo App**. You'll be returned to the Dashboard's **Applications** view.

   ![Demo app setup summary](/files/A9ApQUwvWDpUFAY7Sl2W)
6. Find the **Benchmark** app and click to open the [application overview](/sast-and-sca/prezero/ui/application-overview.md).

   ![OWASP Benchmark Vulnerability Summary](/files/b2uxjhLylY7FSgSEfidU)

## Scoring Qwiet AI by Harness results <a href="#scoring-qwiet-ai-by-harness-results" id="scoring-qwiet-ai-by-harness-results"></a>

In addition to running Qwiet AI by Harness against the OWASP Benchmark app, the demo repo comes with the ability to score the quality of the Qwiet AI by Harness findings.

This functionality is implemented via [scripts](https://github.com/ShiftLeftSecurity/field-integrations/) that extract Qwiet results via API and convert them to OWASP-specific categories. This prepared data is then submitted to the official OWASP scoring mechanism via [Maven](https://maven.apache.org/index.html).

By default, scoring runs whenever you create a new pull request in the demo repo that Qwiet created on your behalf. However, you can also manually run this workflow."

To download the scorecard that Qwiet generates:

1. In the OWASP Benchmark repo that Qwiet created, go to **Actions**.
2. Find the most recent run (if you haven't renamed the job, it should be called its default name: **Add GitHub Action: Qwiet NextGen Static Analysis**) and click to open.
3. Scroll to the bottom to find the **Artifacts** produced during runtime.
4. Click **Benchmark\_v1.2\_Scorecard\_for\_ShiftLeft** to download the zip file.

![GitHub Action Summary View](/files/Qa3NMFGGXBrq4B0E2czi)

### Scorecards <a href="#scorecards" id="scorecards"></a>

The **Benchmark\_v1.2\_Scorecard\_for\_Qwiet.zip** file contains multiple files. We recommend beginning with the following files:

* **OWASP\_Benchmark\_Home.html**: introduces the Qwiet AI by Harness overall results
* **OWASP\_Benchmark\_Guide.html**: provides explanations of the metrics calculated and how to interpret results
* **Benchmark\_v1.2\_Scorecard\_for\_Qwiet.html**: an in-depth scorecard for Qwiet AI by Harness

In addition to the Qwiet AI by Harness overall results, you can see scorecards for individual vulnerabilities (i.e., open **Benchmark\_v1.2\_Scorecard\_for\_Insecure\_Cookie.png** to see how well Qwiet AI by Harness did when identifying insecure cookie vulnerabilities).