From 8874145874d3d19a683b1cd386cfcf668ae50e37 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Tue, 22 Sep 2026 13:56:00 +0200 Subject: [PATCH] measure(contributor-scan): confirm 7.7 costs the small population nothing PMPro at 25 regions, which completed before this work and still does: 27 questions completed and 19 findings before and after, injection 1 and output encoding 18 in both. The batching changes what a large population can afford and nothing about what a small one answers. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- .../2026-09-22-sink-weighted-batching.json | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/benchmarks/measurements/2026-09-22-sink-weighted-batching.json b/benchmarks/measurements/2026-09-22-sink-weighted-batching.json index 151e3cd..bb45222 100644 --- a/benchmarks/measurements/2026-09-22-sink-weighted-batching.json +++ b/benchmarks/measurements/2026-09-22-sink-weighted-batching.json @@ -70,5 +70,23 @@ "Raw finding counts are dominated by output encoding, which is the family already measured to be imprecise on PHP because the WordPress escapers are absent from a sanitizer list that cannot separate weakness classes. More findings there is not better detection.", "One subject. The saving depends on how common each family's sinks are in a codebase, which is a property of the code and the ontology together.", "The reserve share of a fifth is a first value, chosen because the phases after querying took roughly 220 s for 400 questions on this subject. It is not tuned." - ] + ], + "no_finding_lost_at_the_small_population": { + "subject": "PMPro at 25 regions, which completed before this work and still does", + "before": { + "completed": 27, + "findings": 19, + "seconds": 465.9 + }, + "after": { + "completed": 27, + "findings": 19, + "seconds": 460.5 + }, + "per_family": { + "injection": "1 before, 1 after", + "output_encoding": "18 before, 18 after" + }, + "reading": "Identical. The batching changes what a large population can afford and nothing about what a small one answers." + } }