Most tools report what might be wrong. apPosture raises a finding only after it confirms the issue with real, in-band evidence - so engineering can trust the queue and act without re-triaging.
Every finding carries an honest status. We never label something "proven" without evidence, and we never silently downgrade a real risk.
A real, in-band exploit succeeded - DOM-XSS executed a marker, SQLi was confirmed differentially or by an arithmetic oracle, a blind class was confirmed out-of-band. Ships with a PoC request/response.
Static/SCA evidence shows the vulnerable code is actually imported and reachable from an entry point - prioritized over dead code, but not the same as a proven exploit.
Strong but not in-band proof (for example a one-account BOLA where no clean anonymous boundary exists). Routed to triage, never over-claimed as confirmed.
Modelled from facts (IaC, source, dependency graph) but not yet exercised by a scan - shown as a blind-spot to go and prove.
Benign markers and nonces, read-only where possible. No real outbound exploit, no destructive verbs (DELETE/PUT/transfer), no DoS or bursts against live targets.
Parser-confirmed is not RCE; reachable is not proven. But a method-invoking SpEL/EL injection is critical RCE, and file-read / cloud-metadata SSRF is critical - severity reflects real impact.
Our headline accuracy comes from the public OWASP Benchmark 1.2 - an open, ground-truth suite of 2,740 Java test cases with known true and false positives. It is the one accuracy claim you can reproduce.
True vs false positives across every vulnerability category, scored cross-category - not cherry-picked per class.
100% precision, 99.4% recall on the SAST run against the public suite - a Youden index near 1.0.
A Java SAST ground-truth, not a claim about every language, engine or real-world app. Your codebase is the real test - which is what the PoC is for.
Run it against your own applications during a controlled PoC and compare.
We will prove a finding end-to-end in your environment - request, response and attack chain.