measure(contributor-scan): confirm 7.7 costs the small population nothing

PMPro at 25 regions, which completed before this work and still does: 27 questions completed and 19
findings before and after, injection 1 and output encoding 18 in both. The batching changes what a
large population can afford and nothing about what a small one answers.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-22 13:56:00 +02:00
co-authored by Claude Opus 5
parent 7ad3decf9a
commit 8874145874
@@ -70,5 +70,23 @@
"Raw finding counts are dominated by output encoding, which is the family already measured to be imprecise on PHP because the WordPress escapers are absent from a sanitizer list that cannot separate weakness classes. More findings there is not better detection.",
"One subject. The saving depends on how common each family's sinks are in a codebase, which is a property of the code and the ontology together.",
"The reserve share of a fifth is a first value, chosen because the phases after querying took roughly 220 s for 400 questions on this subject. It is not tuned."
]
],
"no_finding_lost_at_the_small_population": {
"subject": "PMPro at 25 regions, which completed before this work and still does",
"before": {
"completed": 27,
"findings": 19,
"seconds": 465.9
},
"after": {
"completed": 27,
"findings": 19,
"seconds": 460.5
},
"per_family": {
"injection": "1 before, 1 after",
"output_encoding": "18 before, 18 after"
},
"reading": "Identical. The batching changes what a large population can afford and nothing about what a small one answers."
}
}