QFinch uses governed public fixtures, pinned revisions, repeatable runners and retained evidence to evaluate scanner behaviour. Results distinguish engineering coverage from formally approved truth-set recall.
Current evidence boundary
- A selected four-case WebGoat engineering comparison has multi-engine detection evidence for XSS, SQL injection, XXE and IDOR.
- A ten-image crAPI lab detected one of three candidate cases and retained two authorization-logic misses.
- Java fixtures now build before SpotBugs.
- Four governed SCA fixtures preserved supported dependency relationships through SPDX conversion with zero conversion-loss warnings.
Independent DAST truth approval is still pending. These results must not be represented as independently validated recall or market parity.
CTA: Read the QA methodology