Accuracy, in the open
The accuracy scoreboard.
Every vendor claims accuracy. We publish ours: recall and false positives on public benchmark apps, produced by the same gate our CI enforces on every release. Zero false positives on our published control targets, enforced on every release. Recall is shown as it is, and it climbs.
Latest verified run
Results from the release gate.
| Target | Recall | Bug classes | False positives | Scan time |
|---|---|---|---|---|
| The scoreboard loads live from our release gate. If it doesn’t appear, please check back shortly. | ||||
How this is measured
No cherry-picking.
The targets are public, intentionally vulnerable applications (DVWA, bWAPP, VAmPI, WebGoat, OWASP Juice Shop) plus a hardened control site that a correct scanner must leave silent. Each vulnerable target has a fixed ground-truth list of bug classes.
- Recall
- The share of ground-truth bug classes we detect, per target.
- False positives
- Any finding on the hardened control. The target is zero, enforced: a single false positive fails the release gate.
- Severity
- Every finding’s rating comes from a CVSS 4.0 vector computed in code, not written by a model. A published severity-accuracy measurement is coming.
- Source
- The numbers are generated from
benchmark/baseline.json, the same file our continuous-integration gate blocks a release on.
No scanner finds 100% of bugs, and anyone claiming otherwise is selling something. What we promise is that nothing reaches your report marked proven unless it was reproduced, every finding carries its evidence, and every report states what we tested and what we could not.