license: apache-2.0
language:
- en
task_categories: - text-generation
- text-classification
tags: - security
- red-team
- prompt-injection
- jailbreak
- payloads
- vulnerabilities
- llm-security
pretty_name: RedSec Red-Team Database
size_categories: - 10K<n<100K
configs: - config_name: llm_injection
data_files: llm_injection.jsonl - config_name: web_payloads
data_files: web_payloads.jsonl - config_name: ml_vulnerabilities
data_files: ml_vulnerabilities.jsonl
RedSec Red-Team Database
A curated, multi-category database of attack payloads and vulnerabilities for authorized LLM and application security red-teaming and robustness testing (the same model as garak and PyRIT). Aggregated and normalized entirely from public, openly-licensed sources. No scraping of bug-bounty platforms.
Categories
| Config | Records | Description |
|---|---|---|
llm_injection |
~15,446 | Prompt-injection, system-prompt extraction, and OWASP-LLM probe payloads |
web_payloads |
~614 | Web/offensive payloads (SQLi, XSS, SSRF, command injection, etc.) |
ml_vulnerabilities |
~4,954 | 298 real ML-library CVEs (from NVD) plus 4,656 code-vulnerability patterns |
Record schemas
- llm_injection / web_payloads:
{category, technique, payload, source, success_markers, refusal_markers} - ml_vulnerabilities (cve):
{category, kind:"cve", cve_id, product, severity, description, source} - ml_vulnerabilities (code):
{category, kind:"code", vuln_type, language, task, secure_code, vulnerable_code, source}
Sources and attribution
Aggregated from these openly-licensed sources, with full credit to their authors. Released under Apache-2.0 to cover the mix.
| Source | License |
|---|---|
| swisskyrepo/PayloadsAllTheThings | MIT |
| deepset/prompt-injections | Apache-2.0 |
| reshabhs/SPML_Chatbot_Prompt_Injection | MIT |
| neuralchemy/Prompt-injection-dataset | Apache-2.0 |
| alib011/llm-red-team-probes | MIT |
| CyberNative/Code_Vulnerability_Security_DPO | Apache-2.0 |
| NVD (National Vulnerability Database) CVE feed | Public domain (US Government) |
Scope, ethics, and exclusions
- For authorized security testing and robustness evaluation only (your own systems, or systems you are explicitly authorized to test). Not for unauthorized access.
- Harm-elicitation benchmarks are deliberately excluded. Datasets that engineer prompts to elicit weapons, CBRN, or similar content (e.g. HarmBench, AdvBench harmful_behaviors) belong in a separate refusal-measurement evaluation set, not in an attack library. They are not part of this dataset.
- Intended to feed a red-team harness (attacker -> target -> judge loop) to systematically test authorized targets. The injection probes include
success_markers/refusal_markersfor automated judging.