My Scanner Missed 93% of the Bugs — and That Was the Right First Result

The first time I ran my vulnerability scanner against the industry-standard

benchmark, the bottom line of the scorer's report was this:

$ python scripts/score_benchmark.py --findings out/java.findings.json \

--truth benchmark-java/expectedresults-1.2.csv

OVERALL precision 0.60 recall 0.07 F1 0.13 # abridged