Quiet enough to leave on.

We don't just score against the OWASP Benchmark (F1 0.88, precision 0.85 / recall 0.91) — we run the same engine across 26 mature OSS codebases, 270K lines of real production code, and publish what it finds: just 0.08 false-positives per 1,000 lines, with 111 real known-CVE dependency advisories surfaced as a separate bucket. Signal, not noise.

● full · ◆ AI-pack extended · ○ partial. Deterministic static analysis flags what code can prove — deepest on Go (SSA-based taint), seven languages. AI soft-rule packs reach into the classes static can't fully model: dropped authorization guards, IDOR and mass-assignment (A01), missing rate limits on sensitive routes (A04), unsafe deserialization (A08). A pack rule only gatesonce it clears a precision/recall bar on a curated corpus — until then it's advisory, never a spurious block. We still say where it stops: missing MFA and brute-force gaps need runtime.

AI packs validated on a curated corpus spanning four frameworks — OWASP Top-10, HIPAA, PCI-DSS and SOC 2 — 194 cases across nine languages, regenerated on every eval run. Each rule gates only above its precision/recall bar; the rest stay advisory. See the compliance breakdown below.

Maintainability: E.
So which of the 20 issues do I fix?

That is a real quality gate failing on a real repository, and it is unactionable by construction: the letter is a debt ratio built from remediation estimates the tool guessed at. CommitMind leads with the condition that actually blocks a commit — and shows nothing it cannot source.

There is no A–E rating here, on purpose. That grade is a ratio of remediation effort to development cost, and the effort half comes from per-rule time estimates. We hold no such data, so publishing a letter would mean inventing one and borrowing a name buyers already trust. It is about an hour of work — which is precisely why it would have shipped without anyone deciding it should.

“New” and “resolved” are counted over a trailing window across the whole ledger, not per scan — a per-scan delta reads zero on a quiet afternoon while the week added findings. A repository that has never completed a scan renders as not scanned, never as a green gate over an empty ledger. Figures above are CommitMind’s own repository, read off the shipped panel.

We never run your tests. Coverage is parsed from a report your project already produces, because a tool that executes an arbitrary suite on a background loop — spawning containers, hitting databases, costing money — is a tool people uninstall. The cost is honest: with no report, the panel says not measured and never 0%. An unmeasured repository and an untested one are different claims, and we will not render them the same. The figure is stated in statements for the same reason — Go counts statements and LCOV counts lines, so a bare percentage would invite comparing two numbers that never measured the same thing.

Your AI just shipped a HIPAA violation.
Your linter said nothing.

Generated code drops an authorization guard, logs a card number, sends PHI over plaintext — all valid syntax, all invisible to a linter. CommitMind is the review that gates the commit on HIPAA, PCI, and SOC 2, and proves it with precision and recall — not a logo wall.

194 hand-curated cases across 4 frameworks and 9 languages — each a real violation next to its look-alike safe carve-out. Overall precision 0.99 / recall 0.98, regenerated on every eval run from a committed harness.

A rule gates only once it clears the bar (precision ≥0.85, recall ≥0.50, ≥6 cases); below it, it surfaces but never blocks. We publish what it still gets wrong: a mass-assignment carve-out still false-flags (0.75 precision — so it stays advisory, never a spurious block), and SOC 2 audit-logging recall sits at the gating floor on borderline failed-login diffs. Ruby, PHP, Kotlin and Rust are spot-checked, not yet validated at the depth of Python, JS, Go, Java and C#.