mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 19:59:26 +00:00
Lead with the names a security engineer already knows instead of the coined ones: - catch rate -> recall (true-positive rate) - false-alarm rate -> false-positive rate (still reported as false alarms per 100 pushes) - proved-catch / proof rate -> exploit-verified findings (a working proof of concept) - precision stays precision (positive predictive value) The plain-English question for each metric stays as the explanation. Updated the valid-benchmark brief and the roadmap. No numbers changed. Co-Authored-By: Claude Opus 4.8 <[email protected]>