SAMATE Logo NIST Logo The SAMATE Project Department of Homeland Security

Welcome to the NIST Software Assurance Reference Dataset Project

The purpose of the Software Assurance Reference Dataset (SARD) is to provide users, researchers, and software security assurance tool developers with a set of known security flaws. This will allow end users to evaluate tools and tool developers to test their methods. These test cases are designs, source code, binaries, etc., i.e. from all the phases of the software life cycle. The dataset includes "wild" (production), "synthetic" (written to test or generated), and "academic" (from students) test cases. This database will also contain real software application with known bugs and vulnerabilities. The dataset intends to encompass a wide variety of possible vulnerabilities, languages, platforms, and compilers. The dataset is anticipated to become a large-scale effort, gathering test cases from many contributors. We have more information about the SARD, including goals, structure, test suite selection, etc.

Browse, download, and search the SARD

Anyone can browse or search test cases and download selected cases.

To browse the test case repository or download test cases, click here.

To find specific test cases, click here.

To download test suites, click here.

How to submit test cases

We welcome submission of software artifacts with security vulnerabilities. We also welcome samples of avoiding or mitigating such vulnerabilities. A test case consists of one or more files that manifests the security error, and metadata about the file(s), such as the platform, language, etc. To submit a test case, please contact the SAMATE team.


We would like to thank all who have contributed to the Software Assurance Reference Dataset.

Other Assurance Tool Test Collections

We are compiling a list of other (non-SAMATE) assurance tool test collections. If you have have a test collection that meets the acceptance criteria specified on that page, please submit your suggestion to SAMATE.