Website evidence tables

An empty cell means not applicable or unavailable as stated in `columns`; it never means zero.

1. class_recall.csv

   Basis

   main runs; endpoint-aware configurations; most classes are small

   Units

   counts

   Paper

   Appendix C, Figure 21

   class_recall.csvclass_recall.meta.json

2. configurations.csv

   Basis

   as run

   Units

   text

   Paper

   Table 2, Appendix B

   configurations.csvconfigurations.meta.json

3. corpus_by_language.csv

   Basis

   frozen reference set

   Units

   counts

   Paper

   Table 1

   corpus_by_language.csvcorpus_by_language.meta.json

4. deepsec_funnel.csv

   Basis

   DeepSec 2.3.7; the scan stage is model-free and identical for both backends; localized recall is not comparable with Attacker-Reachable Vulnerability Recall

   Units

   counts

   Paper

   Figure 9

   deepsec_funnel.csvdeepsec_funnel.meta.json

5. efficiency.csv

   Basis

   main runs, single run per cell; DeepSec rows use localized-recall matches and are never compared with the others

   Units

   hours, seconds, USD, millions of tokens, ratio

   Paper

   Figures 10 and 11, Section 5

   efficiency.csvefficiency.meta.json

6. flow_shape.csv

   Basis

   endpoint-aware configurations

   Units

   counts

   Paper

   Figure 4

   flow_shape.csvflow_shape.meta.json

7. greedy_cover.csv

   Basis

   endpoint-aware configurations only

   Units

   counts

   Paper

   Figure 2A

   greedy_cover.csvgreedy_cover.meta.json

8. headline.csv

   Basis

   main runs, one per configuration and application; frozen reference set

   Units

   percent and counts

   Paper

   Table 4, Table 3, Figure 1, Figure 8

   headline.csvheadline.meta.json

9. match_matrix.csv

   Basis

   main runs; frozen reference set; vuln_id is the reference-set id in the public repository

   Units

   booleans

   Paper

   Figures 2 and 3

   match_matrix.csvmatch_matrix.meta.json

10. overlap_intersections.csv

    Basis

    endpoint-aware configurations; the three Codex Security configurations pooled

    Units

    counts

    Paper

    Figure 3

    overlap_intersections.csvoverlap_intersections.meta.json

11. pairwise_union.csv

    Basis

    endpoint-aware configurations only (DeepSec excluded)

    Units

    counts

    Paper

    Section 3.2, 3.5

    pairwise_union.csvpairwise_union.meta.json

12. per_app.csv

    Basis

    main runs; one run per configuration and application

    Units

    counts

    Paper

    Appendix C, Figure 20

    per_app.csvper_app.meta.json

13. policy_class_detail.csv

    Basis

    main runs; endpoint-aware configurations

    Units

    counts

    Paper

    Figure 6B

    policy_class_detail.csvpolicy_class_detail.meta.json

14. policy_class_recall.csv

    Basis

    main runs; endpoint-aware configurations

    Units

    counts

    Paper

    Figure 6A

    policy_class_recall.csvpolicy_class_recall.meta.json

15. policy_control_supplementary.csv

    Basis

    SUPPLEMENTARY: single run on 19 of the 20 applications, about a month after the main runs; never merge into main tables, unions or rankings

    Units

    counts

    Paper

    Section 4.1, Figure 6 (dashed outline)

    policy_control_supplementary.csvpolicy_control_supplementary.meta.json

16. rank_stability.csv

    Basis

    the main runs' saved findings rescored under each rule; the first row is the rule used for all results; DeepSec excluded

    Units

    ranks

    Paper

    Figure 12

    rank_stability.csvrank_stability.meta.json

17. sol_sink_offsets.csv

    Basis

    Codex Security with GPT-5.6 Sol; the 57 missed curated sinks with a reported location in the same file

    Units

    counts of missed sinks

    Paper

    Figure 7

    sol_sink_offsets.csvsol_sink_offsets.meta.json

18. tolerance_sweep.csv

    Basis

    endpoint rule; only 2 is used for results, the rest are counterfactual rescorings; DeepSec excluded (see Figure 8B)

    Units

    counts

    Paper

    Figure 8A

    tolerance_sweep.csvtolerance_sweep.meta.json