Security-success

The per-unit rate at which security-reviewer surfaces findings on agent-generated PRs — the measured catch record of the compensating control, trailing 30 days. As of 2026-08-27 07:50 MST.

Blocking / KLOC

0.15

PRs w/ a blocking vuln

13.2%

Agent PRs reviewed

296

Internal escapes

"Internal escapes" is a proxy — blocking findings caught late, not confirmed damage in production.

WAITING ON THE KEEL — a look-back feed (a security revert or incident tied to its PR) that the security-scorecard harvester does not build yet

claim last verified 2026-08-26

By producer model

Model	PRs	Changed LOC	Findings	Blocking	Blk / KLOC	% w/ blocking
claude-sonnet-4-6	109	42,144	40	11	0.26	7.3%
deepseek/deepseek-v4-flash	71	26,025	22	6	0.23	8.5%
claude-sonnet-5	114	271,261	110	35	0.13	21.9%
claude-opus-5	2	7,368	0	0	0.00	0.0%

By repo

Repo	PRs	Changed LOC	Findings	Blocking	Blk / KLOC	% w/ blocking
Vela	5	669	5	3	4.48	40.0%
Platform & internal	109	52,602	103	30	0.57	18.3%
Lyra	132	278,090	49	19	0.07	12.9%
Pavo	1	2	0	0	0.00	0.0%
Orion	5	1,696	3	0	0.00	0.0%
Corvus	44	13,739	12	0	0.00	0.0%

Findings per KLOC counts security-reviewer findings (blocking + non-blocking) against the PR's changed lines (additions + deletions), so a small and a large PR compare fairly. Blocking = a real vulnerability that should not ship as-is; non-blocking = a security concern that's real risk but not a hard vuln.
% PRs with a blocking vuln is the share of reviewed agent PRs that carried at least one blocking security finding — the headline "how often does agent code ship a caught vulnerability" rate.
Internal escapes are blocking findings that first surfaced on review round ≥2 — the earlier round missed them. This is the measurable proxy for "escaped to later".
The rate colouring is a soft read (zero clean, above flagged), not a policy threshold — the threshold gets set from this baseline once enough is measured.
Verdicts and finding counts are parsed from the stamped ARCH-033 review comments (agentctl review-post), so each is authentic and pinned to the exact commit reviewed.