False Positive

A false positive is a finding that turns out not to be a vulnerability: the code is safe, the path is unreachable, or the impact was misread. Its opposite, the false negative, is a real bug the review never reported.

False positives cost review time. Every one has to be read, reproduced and dismissed, and a tool that raises many of them trains its users to ignore its output. That is why static analysis tools and AI auditors put a lot of effort into filtering them out.

Why zero false positives is not "safe"

Precision and recall measure different things. A tool can raise zero false positives and still miss most of the bugs present. In five blind audit contests, our own AI auditor, Krait v8, raised 10 findings with zero false positives, while the judges confirmed 66 High and Medium bugs. A tool that never cries wolf feels trustworthy, but its silence says nothing about what it did not check.

Keeping false positives honest

The cleanest filter is mechanical: a finding is real when a proof of concept runs and shows the harm, and stays open until it does. Report false-positive rates together with recall, and with the code they were measured on.