Method
How to read a report
What Agreement, evidence level and coverage mean, and what we do not claim.
Agreement, not "confirmed"
A finding is reported by N of M tools. We also count independent voices: tools on the same model family count as one. Agreement raises attention, not certainty. Every upstream tool in the catalog runs on the same model family today, so agreement in a current report is one voice, and the report says so.
We use confirmed only for a finding with a passing proof of concept or a static check behind it. Otherwise the report says "reported by 2 of 3 tools".
Evidence levels
| Level | Meaning |
|---|---|
| code-trace | The tool traced the issue in the code; nothing was executed. |
| static-confirmed | A static analysis check backs the finding. |
| poc-pass-fork | A proof of concept ran on a fork and passed. |
| poc-fail | A proof of concept ran and failed; the finding is kept as a lead. |
| not-verified | No independent check. |
Coverage
Files in scope, files actually read, and files skipped and why. A clean report can mean a clean repository or a timeout; the coverage section tells them apart.
Discarded findings
We keep the false positives we filtered, with the reason and the tool that raised them, so you can check our call.
Severity
Severity combines impact and likelihood and is normalized to four levels: Critical, High, Medium, Low. Each tool uses its own labels; the report shows the normalized level, and the raw label stays available in the JSON export.
Single-tool findings
Findings seen by one tool are listed as leads, not hidden. They are marked as having no independent confirmation.
What the report does not say
- It is not a guarantee, and it does not replace a human audit.
- Zero findings does not prove that nothing is wrong.
- It describes one commit at one point in time.
- We publish no benchmark numbers yet. When we measure quality we will publish the method and the date with the result.
- Third-party tool names are listed for transparency and imply no endorsement.