Recall

Recall measures coverage. If a codebase holds 66 real bugs and a review finds 10 of them, its recall is 10 / 66, or 15.2%. The other 56 are false negatives: real bugs the review walked past.

Recall is the number a clean report hides. A report lists what was found; it does not list what was missed, so a review with low recall and a review with high recall can return the same "no findings" on the same contract.

Recall vs precision

Precision is the share of reported findings that are real. A tool with zero false positives has perfect precision on that run, and can still have very low recall. In five blind audit contests, our own AI auditor, Krait v8, raised 10 findings, all real, while the contests' judges confirmed 66 High and Medium bugs: perfect precision on that run, 15.2% recall.

The two trade against each other. A tool tuned never to cry wolf stays quiet on anything it is unsure about, and that is where many real bugs live.

Measuring it yourself

Recall can only be measured against bugs you already know. Ways to build that set:

• Past findings from your own audits, with the fixes reverted on a branch.
• Judged public audit contests, scored against the official results (a shadow audit).
• A corpus of planted bugs with an answer key sealed before the tool runs.

Track recall on every new version of a tool, alongside its false-positive rate, and keep each known bug as a regression test so it fails loudly if it comes back.