From bd7b7db25d751e8d0e11529f4caf9eb9a2a558d0 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:18:05 +0200 Subject: [PATCH] docs(benchmark): drop two em-dash headings in the brief Co-Authored-By: Claude Fable 5.1 --- .kiro/specs/valid-detection-benchmark/brief.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.kiro/specs/valid-detection-benchmark/brief.md b/.kiro/specs/valid-detection-benchmark/brief.md index 6decaaf..6f83f38 100644 --- a/.kiro/specs/valid-detection-benchmark/brief.md +++ b/.kiro/specs/valid-detection-benchmark/brief.md @@ -20,7 +20,7 @@ reports the hook as shipped and the hook plus the hunter arm separately until th ## What makes the data valid -### Positive cases — "should catch" (real, verified, reachable vulnerabilities) +### Positive cases: "should catch" (real, verified, reachable vulnerabilities) - Take the label from the security fix, never from SZZ. Use the code *just before* the fix, at the file/function the fix changed. The fix establishes the vulnerability location without a blame walk-back or mislocation. - Keep only app-shaped cases where the vulnerability is reachable from an entry point *inside the repo*. This @@ -29,7 +29,7 @@ reports the hook as shipped and the hook plus the hunter arm separately until th - Verify each case through LLM adjudication and a human spot-check. Confirm (a) that the pre-fix code is vulnerable and (b) that the fix addresses it. Also confirm (c) that it is reachable in-repo. -### Negative cases — "should not alarm" (ordinary safe changes) +### Negative cases: "should not alarm" (ordinary safe changes) - Use everyday commits from the **same** application repositories that are not security fixes. They are plentiful and cheap to collect. Almost every real push is ordinary, so false alarms determine whether developers keep using the tool. The negative set must be much larger than the positive set.